CVE-2026-35087

Executive Summary

CVE-2026-35087 is a critical authentication bypass vulnerability (CVSS 9.3, Critical) in Slican telephone exchange systems that allows unauthenticated remote attackers to bypass administrative protocol authentication entirely. Affected products include the NCP, IPx series, CCT-1668, MAC-6400, and CXS-0424 platforms. The vendor has released patched firmware for supported models (NCP: 1.24.0250; IPx: 6.61.0040; CCT-1668/MAC-6400: 6.56.0430; CXS-0424: 6.30.0510); however, end-of-life units running version 4.xx and below are permanently vulnerable with no fixes available. Successful exploitation grants full administrative control over telephone infrastructure, enabling call interception, service disruption, and lateral movement into the corporate voice network.

Technical Analysis

Slican telephone exchanges implement a proprietary administrative protocol for device configuration, user management, and system provisioning. This protocol runs over the network and is typically bound to standard telephony management ports. The vulnerability resides in the authentication mechanism of this administrative interface — specifically, an improper authentication check in the protocol handler logic (CWE-288: Authentication Bypass Using an Alternate Path).

The flaw allows an attacker to send a crafted administrative protocol command sequence that causes the authentication state machine to be skipped or short-circuited. Rather than requiring the exchange to validate credentials and establish a session token, the vulnerable firmware accepts a predefined "bypass token" or a malformed command ordering that transitions the system directly into an authenticated administrative context. The NVD description indicates the bypass is achieved by "executing the appropriate command," which implies the authentication gate is a separate command that can be omitted, malformed, or replaced with a no-op equivalent that the server fails to validate.

From a code perspective, this is characteristic of a flaw in a check_auth() or validate_session() function that is either not invoked on all code paths (alternate path) or returns a success status based on a default/initialized state. The administrative protocol likely parses incoming frames with an opcode or command type field; when a request is received with a particular command identifier, the server's dispatch table routes it to a handler that assumes the caller has already authenticated. No session state verification is performed by the handler, allowing direct invocation of privileged operations.

The attack surface is fully remote. VoIP exchanges in enterprise environments are typically reachable from the internal network, and often from the internet due to poor firewall segmentation or remote-management convenience. Slican systems are widely deployed in Central/Eastern European enterprises, government agencies, and telecommunication providers, making them an attractive target. No specialized hardware or credentials are required — only network-level access to the administrative protocol port.

Exploitation Scenarios

The following attack chain demonstrates how an attacker would exploit CVE-2026-35087:

Step 1 — Reconnaissance: The attacker begins by scanning for Slican telephone exchanges using Shodan with dorks such as title:"SLICAN" phone or Slican PBX. These systems often expose web-based maintenance interfaces on TCP port 80/443 and administrative protocol ports on TCP 8888–8999 (commonly 8888, 8889) or UDP ports used for phone registration (UDP 5060 SIP or proprietary ports 10000–20000). Nmap detection: nmap -p 80,443,8888,8889 <target> — identify Slican's distinctive banner or service identification.

Step 2 — Protocol Fingerprinting: The attacker uses a python script to connect to the administrative protocol port identified. Slican's admin protocol uses binary framing with a header containing a magic number (e.g., 0x534C or "SL"), a command/opcode field, length field, and payload. The attacker sends benign commands (like GET_VERSION) without authentication to observe the server's response behavior, confirming the existence of the vulnerable service and mapping command opcodes via fuzzing.

Step 3 — Authentication Bypass Trigger: The attacker sends a crafted administrative packet. The packet is constructed as follows: the correct header with a target opcode (e.g., OPCODE_CFG_WRITE = 0x0032), but the authentication token field is either set to a nullable placeholder, or the authentication sequence (OPCODE_AUTH) is intentionally omitted from the command sequence. The vulnerable firmware processes the request and enters the privileged handler without any credential check. A typical exploit frame:

[Header: Magic=0x534C, Length=0x0014, Checksum=0x0000]
[Opcode: 0x0032 (CFG_WRITE)]
[AuthFlag: 0x0000 (bypassed)]
[Payload: administrative settings with attacker-chosen values]

Step 4 — Payload Execution / Post-Exploitation: With the authentication bypass confirmed, the attacker gains full administrative access to the phone system. Concrete post-exploitation actions:

1. Add a new admin account — attacker establishes persistent administrative credentials (set_admin_user command with a cleartext password).
2. Extract the phonebook and call detail records (CDR) — command get_cdr dumps all call logs, revealing internal organizational structure, external calling habits, and potential intelligence targets.
3. Enable call forwarding / tapping — attacker reconfigures trunk properties (set_trunk_config) to forward all inbound/outbound calls to a SIP URI under their control, enabling bulk call interception and audio recording (via a co-located SIP server).
4. Deploy a dial-through backdoor — attacker configures an out-of-hours dialing rule (set_call_route) that allows any caller to dial a predefined access code and reach the internal network or PSTN at the organization's expense.
5. Disrupt service — attacker issues factory_reset or disable_extension * to knock out connectivity for all extensions, causing operational outage.

Realistic caveat: While no public PoC exists, the vulnerability is trivially exploitable given the simple command-order bypass mechanism. In the real world, Slican exchanges are commonly deployed on flat networks or with NAT port-forwards for vendor remote support, exposing the admin protocol directly to the internet.

Impact Assessment

The CVSS 9.3 score reflects unauthenticated, remote, high-impact exploitation. From the available data, the vector is network-based with no privilege requirements, no user interaction, and high confidentiality, integrity, and availability impact.

Business Impact:

• Confidentiality: Call recordings, call detail records (CDRs), and voicemail boxes are exposed. For industries subject to regulatory compliance (EU GDPR, financial services, healthcare), this constitutes a reportable data breach involving personal communications data.
• Integrity: Attackers can manipulate routing tables, interfere with call billing, impersonate the switch for phishing (vishing), and plant backdoors in firmware configuration for persistent presence.
• Availability: A single command can take down all telephony services. For hospitals, emergency services, or 24⁄7 operations, this becomes a life-safety issue; for call centers, a direct revenue loss.

Affected Systems: The completely unpatched and permanently vulnerable end-of-life models (CCT-1668 with CCT1CPU, MAC-6400, CXS-0424 on firmware 4.xx and below) are still in production in many organizations, despite being discontinued in 2011–2012. The blast radius extends beyond the PBX itself — since PBX systems often have a management network segment, a compromised PBX can be used as a pivot point into the broader corporate IP network.

Detection Guidance

Sigma Rule

title: Slican PBX Administrative Authentication Bypass Exploitation
id: 8a1c8e9f-3c2d-4b5e-9a8f-6d7c0b1a2e3f
status: experimental
description: Detects anomalous administrative commands sent to Slican telephone exchanges without prior authentication, indicating exploitation of CVE-2026-35087.
author: Valters IT Security Team
date: 2026/06/15
logsource:
    category: network_connection
    product: firewall
    service: netflow
detection:
    selection:
        dest_port:
            - '8888'
            - '8889'
        bytes_sent: '> 200'
    filter_known_management:
        src_ip:
            - '192.168.10.0/24'   # Adjust to known admin CIDR
    condition: selection and not filter_known_management
fields:
    - src_ip
    - dest_ip
    - dest_port
    - bytes_sent
    - protocol
falsepositives:
    - Legitimate vendor remote support connections from approved IPs
level: high
tags:
    - attack.t1190
    - cve.2026-35087

YARA Rule

rule slican_auth_bypass_packet
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects binary packets targeting Slican PBX admin protocol with authentication bypass characteristics"
        cve = "CVE-2026-35087"
        date = "2026-06-15"
    strings:
        $magic1 = { 53 4C 49 43 }    // "SLIC"
        $magic2 = { 53 4C 41 4E }    // "SLAN"
        $opcode_cfg_read = { 00 30 }
        $opcode_cfg_write = { 00 32 }
        $opcode_user_add = { 00 44 }
        $auth_null = { 00 00 00 00 }
    condition:
        ( $magic1 or $magic2 ) and
        ( $opcode_cfg_read or $opcode_cfg_write or $opcode_user_add ) and
        $auth_null
}

Suricata IDS Rule

alert tcp any any -> any 8888 (msg:"ET EXPLOIT Slican PBX Admin Auth Bypass Attempt (CVE-2026-35087)"; flow:to_server,established; content:"|53 4c 49 43|"; offset:0; depth:4; content:"|00 32|"; distance:8; within:2; content:"|00 00 00 00|"; distance:2; within:4; classtype:attempted-admin; sid:20935087; rev:1; metadata:created_at 2026_06_15, cve CVE-2026-35087, mitre_tactic TA0001, mitre_technique T1190;)

Elastic Detection

sequence by destination.ip with maxspan=30s
  [network where destination.port == 8888 and network.protocol == "tcp" and network.direction == "ingress"]
  [network where destination.port == 8888 and network.bytes >= 200 and source.ip not in ["192.168.10.0/24"]]

Splunk SPL Query

index=netflow OR index=firewall
| search dest_port=8888 OR dest_port=8889
| where bytes_sent > 200
| eval src_known = if(match(src_ip, "192.168.10.0/24"), "yes", "no")
| search src_known=no
| table _time, src_ip, dest_ip, dest_port, bytes_sent, protocol
| sort - _time

Wazuh OSSEC Rule

<group name="slican,">
  <rule id="100501" level="10">
    <if_sid>100000</if_sid>
    <decoded_as>json</decoded_as>
    <match>dest_port":"8888</match>
    <description>Slican PBX (CVE-2026-35087): Unauthenticated admin command sent from non-admin IP</description>
    <field name="src_ip">!192.168.10.0/24</field>
    <group>attack.t1190,slican,cve-2026-35087,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor patch is confirmed by any tracked source. The described "fixed versions" are firmware releases shipped only for supported/current hardware models. End-of-life systems (CCT-1668/CCT1CPU, MAC-6400, CXS-0424 on 4.xx and below) receive no updates and are permanently vulnerable.

Immediate Mitigations (all applied at the network perimeter):

1. Network segmentation: Isolate the Slican PBX management network from the general corporate LAN. Place the PBX and its administrative protocol port (TCP 8888/8889) behind a firewall with a strict allowlist of only authorized management IPs.
2. Disable remote exposure: Remove any NAT port-forward rules that expose the Slican admin protocol to the internet. If remote management is required, use a VPN tunnel (IPsec/OpenVPN) rather than direct internet-facing services.
3. Monitor and alert: Deploy the Sigma/Elastic/Splunk detections above to alert on anomalous administrative connection attempts to the PBX.
4. Disable the vulnerable service entirely where possible: If the administrative protocol is not actively used (only web-based management is required), disable the legacy admin protocol service in the Slican configuration.

Patch/Upgrade Steps:

1. For supported hardware: Upgrade NCP to version 1.24.0250, IPx series to version 6.61.0040, CCT-1668/MAC-6400 to version 6.56.0430, and CXS-0424 to version 6.30.0510. Contact Slican service to obtain the firmware packages.
2. For EOL hardware (4.xx and below): Firmware upgrades are impossible without hardware replacement. Contact the Slican service department directly to formalize a hardware refresh plan. Until replaced, treat the PBX as compromised-by-default and restrict all network access as described above.

Long-Term Hardening:

1. Hardware refresh: Budget for the replacement of EOL solutions with current-generation Slican (or another) PBX hardware that is under active support.
2. VoIP-specific network hardening: Configure the PBX behind a session border controller (SBC), which can enforce SIP-level authentication and hide the administrative interface entirely.
3. Logging and retention: Enable full auditing on the PBX management plane and retain logs for at least 12 months for forensic purposes.
4. Vendor security review: Include the PBX in routine vulnerability assessment and penetration testing cycles. Due to the long support lifecycle of telephone infrastructure, ensure new hardware has documented security support SLAs.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-35087 (official CVE publication, includes NVD description and score).
2. CERT-PL Advisory: Official advisory from CERT Polska detailing the affected versions and end-of-life guidance (available via CERT-PL security bulletins; referenced in original disclosure).
3. Slican Vendor Support Page: https://www.slican.com/en/support — vendor documentation and service contact for hardware upgrade options (referenced in CVE description).
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application, the relevant tactic/technique mapping.
5. CISA Known Exploited Vulnerabilities Catalog: No entry for CVE-2026-35087 as of reporting date. EPSS score is 0.00662 (48.1st percentile), indicating low current exploitation probability but should be re-evaluated regularly given no public PoC exists yet.

Threat Actor Campaigns: No known in-the-wild exploitation campaigns have been reported to CISA or CERT-PL for this CVE at the time of writing. Given the minimal EPSS score and the absence of public exploits, exploit-in-the-wild activity is considered unlikely in the imminent short term; however, due to the low difficulty of the bypass and the large installed base of EOL hardware, this assessment should be revisited following any public proof-of-concept release.