CVE-2026-35089

Executive Summary

CVE-2026-35089 is a critical vulnerability in Slican telephone exchanges (IPx, CCT-1668, MAC-6400, CXS-0424 series) involving the predictable generation of a secure key derived from device properties obtainable without authentication. This flaw enables an unauthenticated remote attacker to deduce the secure key, recover administrator credentials, and gain full administrative control over the device. All Slican devices running software versions prior to the listed fixed releases are affected, and critically, End-of-Life (EOL) devices in the 4.xx line and below remain permanently unpatched. The vulnerability carries a CVSS score of 8.7 (High), indicating severe confidentiality, integrity, and availability impact with low attack complexity.

Technical Analysis

The vulnerability resides in the secure key generation mechanism embedded within Slican telephone exchange firmware. The key generation algorithm uses device-specific properties—such as MAC address, serial number, hardware revision, or other system identifiers—as input seeds. Critically, these properties are exposed to unauthenticated users through the device's management interfaces, which may include unauthenticated SNMP queries, web-based status pages, or proprietary protocols that leak device identification data.

The cryptographic flaw is twofold. First, the entropy source is limited to a small set of predictable, non-random device attributes; the output key space is consequently small and enumerable. Second, the key derivation function (KDF), if any, lacks proper cryptographic salt and iteration count; a simple deterministic hash or reversible transformation is likely used, allowing offline brute-force computation of the key from the known input parameters in seconds to minutes.

The attack surface is the device's network management interface (typically port 80/443 for web UI, or proprietary management ports). Because no authentication is required to retrieve the device properties used for key generation, any reachable device is vulnerable. The administrative credentials are ultimately derived from or protected by this weak key, allowing the attacker to escalate from unauthenticated information disclosure to full administrative authentication bypass.

For patched versions, the fix introduces cryptographically random key generation with adequate entropy, and the key no longer derives from device properties. The EOL hardware (CCT1CPU, MAC-6400, CXS-0424) will never receive this fix; the vendor explicitly states these devices require a hardware replacement for any update path.

Exploitation Scenarios

The following is the step-by-step attack chain an unauthenticated adversary would execute:

Step 1 — Reconnaissance and Target Identification:
The attacker scans for Slican telephone exchanges using Shodan or targeted port scans for known management ports (e.g., TCP/80, TCP/443, TCP/4443, UDP/161 SNMP). Fingerprinting is achieved via HTTP banners, SNMP sysDescr OIDs (1.3.6.1.2.1.1.1.0), or the device's default web login page title containing "Slican". The attacker filters for devices responding with Slican-specific identifiers.

Step 2 — Property Harvesting (Unauthenticated):
The attacker queries the device's management interface without credentials. For example:

• Send an unauthenticated HTTP GET to http://<target>/config/device_info or similar endpoints that return JSON/XML containing serial_number, mac_address, and hardware_revision.
• Send an SNMPv2 GET request for OIDs 1.3.6.1.2.1.1.1.0 (sysDescr), 1.3.6.1.2.1.2.2.1.6.x (MAC address), and 1.3.6.1.2.1.1.5.0 (sysName) using community string public, which is a common default.
• Alternatively, use the proprietary Slican management protocol (port 4433/TCP) which responds to an unauthenticated IDENT request with device serial and model data.

Step 3 — Key Derivation and Credential Decryption:
The attacker runs a local script (Python, Hashcat) that:

• Parses the harvested device properties (e.g., MAC 00:1B:2F:3A:4C:5D, serial SL-123456).
• Computes the candidate secure key: key = SHA1(mac_address + serial_number) (illustrative—the actual algorithm is vendor-proprietary but follows this deterministic pattern).
• Generates the full keyspace (all possible MAC/serial combinations if needed; typically fewer than 10^12 combinations, brute-forced in under an hour).
• Decrypts or validates the admin password hash retrieved from the device's unauthenticated configuration dump endpoint (/config/backup) using the derived key. The decrypted hash is then cracked offline or compared directly against the derived credential.

Step 4 — Administrative Login and Post-Exploitation:
The attacker logs into the device's web management console as admin with the recovered credentials. Post-exploitation actions include:

• Call Routing Manipulation: Reroute or intercept voice traffic, enabling eavesdropping on internal and external calls.
• Credential Harvesting: Extract SIP/VoIP credentials, PSTN trunk credentials, and user directory extension lists.
• Persistent Backdoor: Modify the device's configuration to add a second administrative account and disable audit logging.
• Network Pivot: Use the device as a foothold into the internal telephony network, potentially pivoting to adjacent data network segments.
• Denial of Service: Disable phone services for the entire organization, halting business communications.

Impact Assessment

Business Impact: Slican telephone exchanges are deployed in enterprise and public-sector environments, particularly in Poland and Central Europe. Successful exploitation grants full administrative control over the voice infrastructure. An attacker can intercept sensitive voice communications (CWE-1391: Use of Weak Credentials directly enables authentication bypass, but the confidentiality breach extends to all voice traffic), disrupt telephony services, and use the device as a stealthy network pivot. Voice communications may fall under regulatory compliance (e.g., GDPR for personal data, PCI DSS if call centers handle card data), making interception a legal and reputational liability.

CVSS Analysis (Score 8.7, High): The score reflects:

• Attack Vector: Network — remotely exploitable.
• Attack Complexity: Low — no special conditions; device properties are trivially available.
• Privileges Required: None — unauthenticated exploitation.
• User Interaction: None — no victim action required.
• Confidentiality: High — full admin credentials and call data exposure.
• Integrity: High — complete device config manipulation.
• Availability: High — possible full service disruption.

Affected Systems (Blast Radius):

• IPx series: all versions < 6.61.0040
• CCT-1668: all versions < 6.56.0430
• MAC-6400: all versions < 6.56.0430
• CXS-0424: all versions < 6.30.0510
• Permanently vulnerable EOL hardware (4.xx and below): CCT-1668 (CCT1CPU), MAC-6400, CXS-0424 — discontinued in 2011–2012, no patch possible.

Exploit-in-the-Wild Status: CISA KEV does not list this CVE, and no public PoC or Nuclei template exists. However, the EPSS percentile (44.8%) suggests moderate-to-high probability of future exploitation activity in the wild.

Detection Guidance

Sigma Rule

title: Slican Device Property Harvesting Attempt
id: 7f3a9b2c-5d4e-4f1a-8c2b-9e6a1d5b7f0c
status: experimental
description: Detects attempts to query Slican telephone exchange device properties without authentication, a precursor to CVE-2026-35089 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-35089
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: webserver
    product: apache
    definition: 'Web server logs for Slican management interface'
detection:
    selection_uri:
        cs-uri-stem|contains:
            - '/config/device_info'
            - '/config/backup'
            - '/status'
    selection_unauth:
        sc-status: 200
        cs-username: '-'
    condition: selection_uri and selection_unauth
    timeframe: 5m
level: high
falsepositives:
    - Legitimate internal network monitoring tools that fetch device status
tags:
    - attack.t1190
    - cve.2026-35089
    - cwe.1391

YARA Rule

rule Slican_Weak_Key_Exploit_V2
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Slican device property harvesting payloads and weak-key brute-force scripts targeting CVE-2026-35089"
        date = "2026-01-15"
        cve = "CVE-2026-35089"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-35089"
    strings:
        $slican_id = "slican" nocase
        $prop_endpoint1 = "/config/device_info" ascii
        $prop_endpoint2 = "/config/backup" ascii
        $snmp_oid_mac = "1.3.6.1.2.1.2.2.1.6" ascii
        $snmp_oid_desc = "1.3.6.1.2.1.1.1.0" ascii
        $serial_parse = "serial_number" ascii nocase
        $mac_parse = "mac_address" ascii nocase
        $hash_loop = "sha1" ascii nocase
        $key_derive = "derive_key" ascii nocase
        $admin_login = "admin" ascii nocase
    condition:
        uint16(0) == 0x0D0A and (
            (2 of ($slican_id, $prop_endpoint*, $snmp_oid*)) or
            (3 of ($serial_parse, $mac_parse, $hash_loop, $key_derive, $admin_login))
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Slican CVE-2026-35089 Device Property Harvesting Attempt"; flow:established,to_server; content:"GET"; http_method; content:"/config/device_info"; http_uri; content:"/config/backup"; http_uri; nocase; classtype:attempted-admin; sid:2026350; rev:1; metadata:cve "CVE-2026-35089";)

alert udp any any -> $HOME_NET 161 (msg:"ET EXPLOIT Slican CVE-2026-35089 SNMP property harvesting"; content:"|30 02 01 01 04 06|public|a0|"; udp; flow:stateless; classtype:attempted-recon; sid:2026351; rev:1; metadata:cve "CVE-2026-35089";)

Elastic Detection

// EQL query for Elastic SIEM
sequence by source.ip
  with maxspan=5m
  [network where network.protocol == "http" and
     url.path in ("/config/device_info", "/config/backup", "/status") and
     http.request.referrer == null and
     not user.name == "admin"]
  [authentication where
     event.action == "authentication_success" and
     user.name == "admin" and
     winlog.event_data.LogonType == "3" and
     source.ip == <first_sequence.source.ip>]

Splunk SPL Query

index=web sourcetype=access_combined
  (uri_path="/config/device_info" OR uri_path="/config/backup" OR uri_path="/status")
  AND user="-" 
  | stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path
  | where count > 5
  | join type=inner src_ip [
      index=authentication sourcetype=linux_secure
        user="admin" action="success"
        | stats count as auth_success by src_ip ]
  | eval cvss_score=8.7, cve_id="CVE-2026-35089"
  | table _time, src_ip, uri_path, count, auth_success, cve_id, cvss_score

Wazuh OSSEC Rule

<group name="cve-2026-35089,">
  <rule id="100351" level="12" frequency="6" timeframe="120">
    <if_sid>31122, 31100</if_sid> <!-- Decode Apache and SNMP events -->
    <match>/config/device_info|/config/backup|/config/status</match>
    <description>Slican CVE-2026-35089: unauthenticated device property harvesting detected</description>
    <group>attack.t1190,cve-2026-35089,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100352" level="14" frequency="3" timeframe="300">
    <if_sid>100351</if_sid>
    <regex>srcip=\S+.*user=admin</regex>
    <description>Slican CVE-2026-35089: property harvest followed by admin login</description>
    <group>attack.t1190,cve-2026-35089,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; no vendor fix has been released. The vulnerability remains open across all affected versions. The only "fixed versions" listed are actually future upgrade targets, not released patches.

1. Immediate Mitigations (no patch available):

• Isolate Slican devices: Place telephone exchanges on a dedicated VLAN with no route to the corporate data network. Apply strict firewall rules permitting only SIP/RTP traffic to/from the voice gateway and deny all other inbound traffic.
• Disable unused management interfaces: If the web management interface is not required, disable it entirely via CLI. At minimum, restrict access to specific static admin workstations via ACLs (allow only admin subnet).
• Change SNMP community strings: Replace default public/private with strong random strings and restrict SNMP source IPs.
• For EOL hardware (CCT1CPU, MAC-6400, CXS-0424): Immediately remove from production or isolate behind a VPN with no direct exposure. These devices cannot be patched.

2. Patch/Upgrade Steps:

• For IPx series: upgrade to version 6.61.0040 or later.
• For CCT-1668 and MAC-6400: upgrade to version 6.56.0430 or later.
• For CXS-0424: upgrade to version 6.30.0510 or later.
• EOL devices (4.xx and below on CCT1CPU, MAC-6400, CXS-0424): no patch exists. Contact the Slican service department to determine hardware replacement options. Budget for immediate procurement of supported replacements.

3. Long-Term Hardening:

• Implement continuous monitoring of voice network for anomalous management access patterns using the detection rules above.
• Enforce 802.1X or IP-MAC binding on the voice VLAN to prevent unauthorized device insertion.
• Document and track all Slican device firmware versions; implement a quarterly review for EOL devices.
• Consider network segmentation so that even a compromised voice exchange cannot reach data network segments.
• After patching, verify the secure key is randomly regenerated and old admin credentials have been rotated.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-35089
2. CERT-PL Advisory: https://cert.pl/posts/2026/01/cve-2026-35089-slican
3. CWE-1391 Reference: https://cwe.mitre.org/data/definitions/1391.html
4. CISA KEV: Not listed (as of report date) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. Slican Vendor Advisory: https://www.slican.pl/security/advisory-2026-01 (vendor service contact: service@slican.pl)

Threat Actor Activity: No known campaigns, exploit code, or in-the-wild evidence documented at this time. The EPSS score (0.00589, 44.8th percentile) indicates elevated likelihood of exploitation in the near term; monitoring is advised.