Slican patches CVE-2026-35088 in IPx v6.62.0100; legacy models require hardware upgrades to fix

Slican has released version 6.62.0100 of its IPx telephone exchange series to address a high-severity encryption flaw. This update resolves CVE-2026-35088, a vulnerability that exposes network communications to decryption by anyone with access to the device binaries.

What happened

The vulnerability stems from the way Slican telephone exchanges handle symmetric encryption for TCP/IP communication. According to the National Vulnerability Database record for CVE-2026-35088, the secret key required for this encryption is hardcoded directly into multiple binary files on the device. This design choice means the key is present in the files rather than being dynamically managed.

An attacker who gains access to these binary files can extract the hardcoded key. Once the key is obtained, the attacker can decrypt the encrypted traffic flowing through the exchange. The National Vulnerability Database rates this flaw as high severity, with a CVSS score of 8.2, citing CWE-326 as the underlying weakness classification.

Slican addressed this issue in its current IPx product line by releasing version 6.62.0100. This update fixes the issue where the secret key was hardcoded in multiple binary files. Organizations running the IPx series on versions prior to 6.62.0100 are exposed to this risk until they apply the patch.

However, the problem persists in several older, end-of-life telephone exchange models. The Slican CCT-1668 (also known as CCT1CPU), MAC-6400, and CXS-0424 systems remain vulnerable. These products were discontinued in 2011 and 2012. The vendor states that these specific models will not receive software updates to fix the hardcoded key issue.

Why it matters

The persistence of this flaw in legacy systems creates a significant security gap for organizations that have not upgraded their infrastructure. The affected legacy models include the CCT-1668 up to version 6.56.0430, the MAC-6400 up to version 6.56.0430, and the CXS-0424 up to version 6.30.0510.

Because these devices are end-of-life, standard patching procedures do not apply. The vendor indicates that these products require a hardware update to receive any software changes. This means the hardcoded encryption keys will remain in the binaries unless the physical hardware is replaced or upgraded.

Slican recommends that users of these discontinued devices contact their service department directly. The goal is to determine the available options for upgrading the hardware. Without such an upgrade, the TCP/IP communications on these exchanges remain decryptable by anyone who can access the device files.

Our take on the response

• Verify if your environment includes Slican CCT-1668, MAC-6400, or CXS-0424 systems.
• Check the current software version against the vulnerable cutoff points listed in the advisory.
• Contact Slican service departments to discuss hardware upgrade paths for legacy units.
• Apply version 6.62.0100 to all supported Slican IPx series devices immediately.

What defenders should look for

Security teams should monitor for unauthorized access to Slican device binaries and unusual outbound traffic patterns. Look for anomalies in TCP/IP flows that suggest decryption or data exfiltration. Check logs for attempts to read configuration files or binary executables from the exchange systems. If suspicious activity is detected, isolate the affected network segment. Validate that all supported devices are running the latest patched version. Review access controls to ensure only authorized personnel can interact with the hardware.

Background: Unauthorized access

Most teams assume unauthorized access means broken encryption or stolen passwords. In reality, attackers often use valid accounts, legitimate tools, and internal trust relationships. Detection fails because alerts are tuned to look for outsiders, not insiders acting strangely.

Read the full guide: Unauthorized Access Myths: What Detection Actually Misses

What to do and how to stay safe: Slican

• Audit your inventory to identify any Slican IPx devices running versions older than 6.62.0100 and apply the update.
• Identify any legacy CCT-1668, MAC-6400, or CXS-0424 systems and assess their network exposure.
• Contact Slican support to explore hardware upgrade options for end-of-life devices that cannot be patched via software.
• Implement network segmentation to limit access to telephone exchange binaries and monitor for unauthorized file access.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Slican products are affected by CVE-2026-35088?

The vulnerability affects Slican IPx series versions before 6.62.0100, as well as discontinued models CCT-1668, MAC-6400, and CXS-0424 up to their respective maximum versions.

Is there a software patch for the discontinued Slican models?

No, the discontinued models will not receive software updates. They require a hardware update to receive any software changes, according to the vendor.

What is the CVSS score for this vulnerability?

The National Vulnerability Database assigns CVE-2026-35088 a CVSS score of 8.2, which is rated as high severity.