Slican IPx WebCTI Service Exposes Subscriber Passwords in Plaintext
A high-severity flaw in Slican IPx telephone systems allows database access to reveal stored user credentials, enabling account takeover.
Key points
- CVE-2026-63315 affects Slican IPx versions prior to 6.62.0100.
- The WebCTI service stores temporary subscriber passwords in plaintext.
- Attackers with database access can retrieve credentials and log in.
Slican IPx telephone exchange systems contain a high-severity vulnerability that exposes subscriber passwords in plain text. This flaw allows any attacker with access to the underlying database to retrieve credentials and assume control of user accounts.
What happened
The vulnerability, tracked as CVE-2026-63315, resides in the WebCTI service component of Slican IPx telephone exchanges. According to the National Vulnerability Database, this service stores temporary subscriber passwords in plaintext rather than using secure hashing methods. This implementation weakness is classified under CWE-256, which covers insecure storage of sensitive information. The flaw affects all versions of the Slican IPx series prior to version 6.62.0100. Organizations running older firmware remain exposed to this credential storage issue.
An attacker who gains access to the database can directly obtain these stored passwords. Once the credentials are retrieved, the threat actor can log in to the subscriber's account. This bypasses standard authentication protections because the attacker possesses the actual password. The CVSS score for this issue is 8.2, which rates it as high severity. This rating reflects the significant impact of account takeover.
Why it matters
Storing passwords in plaintext eliminates the primary defense against database breaches. If an attacker compromises the database, they immediately possess valid login credentials for all affected subscribers. This allows for direct account takeover without the need for password cracking or brute-force attacks. For security operations teams, this means that database integrity is the only barrier protecting user identities.
The exposure affects the WebCTI service, which is integral to telephone exchange operations. Compromise of subscriber accounts allows attackers to log in to the subscriber's account. Since the flaw exists in versions before 6.62.0100, any deployment not updated to this specific release is vulnerable. The lack of encryption for these temporary credentials creates a persistent risk as long as the service is active.
Our take on the response
Slican has released a fix for this issue in version 6.62.0100. The update addresses the plaintext storage of temporary subscriber passwords in the WebCTI service. Organizations should verify their current IPx version and compare it against the fixed release. Upgrading to version 6.62.0100 or later removes the vulnerability. Delaying the update leaves the database exposed to credential theft.
What defenders should look for
Teams usually monitor database access logs for unusual queries or connections from unexpected sources. Check whether any service accounts have broader permissions than necessary for the WebCTI component. Look for alerts indicating successful logins from new locations or at unusual times, which may signal credential misuse. Investigate any attempts to export or copy large volumes of data from the subscriber database. Review firewall rules to ensure the database port is not exposed to untrusted networks.
What to do and how to stay safe: Slican
- Verify the current version of your Slican IPx system and compare it to 6.62.0100.
- Apply the vendor update to patch the plaintext password storage flaw.
- Rotate all subscriber passwords immediately if you suspect database compromise.
- Restrict network access to the WebCTI service database to authorized hosts only.
Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget
General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Slican IPx versions are affected by CVE-2026-63315?
All versions of the Slican IPx series prior to version 6.62.0100 are affected by this vulnerability.
Is there a fix available for this plaintext password storage issue?
Yes, the issue has been fixed in Slican IPx series version 6.62.0100.
What is the severity rating of CVE-2026-63315?
The CVSS score for CVE-2026-63315 is 8.2, which is rated as high severity.
