CVE-2026-35090

Executive Summary

CVE-2026-35090 is a critical authentication bypass vulnerability affecting Slican telephone exchange systems (IPL-256, IPM-032, CCT-1668, MAC-6400, CXS-0424). An unauthenticated attacker with access to the Public Switched Telephone Network (PSTN) can dial the target exchange's modem number using a specific Caller ID (CLI), which bypasses administrator credentials and grants full access to the service protocol and configuration panel — the vulnerability is independent of the exchange's remote-access configuration, and if remote access is disabled, the spoofed call temporarily re-enables it. Successful exploitation results in full compromise of the telephony infrastructure, enabling call interception, service disruption, and potential pivoting into the underlying network due to the embedded Linux system on the exchange. With a CVSS score of 9.3 (Critical) and no patch for End-of-Life (EOL) hardware, this poses a significant risk to organizations still relying on these legacy communication systems.

Technical Analysis

The vulnerability resides in the authentication mechanism of the Slican telephone exchange's remote management/modem interface. The system is designed to allow remote administration over an analog or ISDN phone line via a modem connection, a common feature for legacy telephony equipment used by managed service providers.

The core flaw is in the Caller ID (CLI) validation logic. The system uses the incoming caller ID as the sole authentication factor for the management modem. Specifically, when a call arrives at the modem number, the system examines the ISDN/Q.931 SETUP message or the analog caller ID (Bell 202 / V.23 FSK modulation) for a specific subscriber number. If this specific number is present, the system immediately grants access to the service protocol — effectively treating the caller ID as a predefined, hardcoded backdoor or master key.

The vulnerability is independent of the configuration because the check for this specific CLI occurs at the firmware level, before any configuration-based access control lists (ACLs) or administrative "remote management enabled" flags are evaluated. When remote access is administratively disabled, the firmware still processes the incoming modem call initiation. On receiving the correct CLI, it does not merely allow the connection; it temporarily flips the remote-access flag to "enabled" for the duration of that call session, granting the attacker a channel into the service protocol.

From a protocol perspective, the "service protocol" (likely a proprietary binary protocol over the raw modem session) exposes management functionalities that include:

• Retrieving and modifying the configuration database (users, extensions, routing rules).
• Direct system shell access via a diagnostic menu.
• Uploading/downloading firmware images.

The attack surface is the public phone network. Since the exchange is connected to the PSTN for regular telephony, the modem is reachable by simply dialing the number of the exchange as if making a voice call or by dialing a dedicated management number if configured. The attacker only needs the phone number of the target exchange; the spoofed caller ID can be generated with a standard SIP gateway or VoIP adapter that allows manual CLI manipulation, a technique commonly used in telephony fraud.

Exploitation Scenarios

The following attack chain describes the exploitation of a Slican CXS-0424 exchange on an unpatched version (e.g., 6.30.0510 and below) or any EOL version.

1. Reconnaissance & Target Identification

   • Targeting: The attacker identifies a target organization using a Slican exchange. This is accomplished via Shodan-looking services for remotely accessible Slican web panels, but more reliably via wardialing: the attacker uses a VoIP adapter to rapidly dial a block of phone numbers in the target organization's range, listening for the distinctive carrier/answer tone of a Slican modem.
   • Fingerprinting: Upon receiving a modem answer tone, the attacker may initiate a handshake to capture the modem's initialization banner (e.g., "Slican OS v6.x") to confirm the exact hardware/model and firmware version.

2. Weaponization & Trigger (Spoofed Caller ID)

   • Setup: The attacker configures a SIP softswitch/VoIP gateway unit to originate a call to the target exchange's main number or the specific modem line extension.
   • Spoofing: The attacker sets the SIP From header and the P-Asserted-Identity (PAI) header to the specific "master" caller ID value (the magic number used by the hardware for tele-diagnostics).
   • Call Placement: The attacker initiates the call. The PSTN delivers the call to the Slican exchange with the spoofed CLI intact (often allowed by carriers unless STIR/SHAKEN is enforced on the terminating side).

3. Execution (Bypass & Access)

   • Authentication Bypass: The Slican exchange's modem card answers the call automatically. The firmware parses the Caller ID field. Upon matching the hardcoded value, the system bypasses the login prompt entirely and presents the Service Protocol Shell directly.
   • Payload: The attacker issues a command to escape the telephony admin menu to the underlying OS, e.g., entering debug and then shell in the proprietary protocol to drop into a Linux root shell on the embedded system.
   • Persistence: The attacker sets a new administrative password for the SIP/web management interface and permanently enables remote access (SSH/Telnet) for return visits.

4. Post-Exploitation Impact

   • Telephony Interception: The attacker modifies call forwarding rules to route all calls for the CEO / CFO to a number controlled by the attacker (vishing setup).
   • Network Pivot: The exchange typically has two NICs (WAN for SIP trunking, LAN for internal phones/network). The attacker uses the LAN interface to scan the internal corporate network for other vulnerabilities, using the Slican device as a stealthy pivot point that is often not monitored by traditional EDR/XDR.
   • Denial of Service: The attacker modifies the dial plan to dump all outgoing calls to a dead line or shuts down the telephony services during business hours.

Impact Assessment

CVSS Analysis (Score: 9.3 / Critical): The vector reflects a vulnerability that is remotely exploitable over the network (PSTN or VoIP interface) with low attack complexity. The impact is High for Confidentiality, Integrity, and Availability, allowing full administrative takeover of the telephony infrastructure, leading to call data exfiltration and service disruption.

Business Impact:

• Loss of Communications: Call centers, emergency lines, and normal operations are disrupted, causing direct revenue loss and operational paralysis.
• Regulatory Compliance: Failure to protect telephony infrastructure can violate PCI-DSS (if in a payment environment), GDPR (for call data privacy), and HIPAA (for healthcare providers).
• Financial Fraud: Attackers use compromised exchanges to place premium-rate international calls (toll fraud), generating massive phone bills before detection.

Blast Radius:

• Affected Systems: Slican IPL-256, IPM-032, CCT-1668, MAC-6400, CXS-0424.
• EOL Risk: Specific hardware lines (CCT-1668, MAC-6400, CXS-0424) released until 2011/2012 are now EOL; these devices cannot be patched and require hardware replacement, leaving a permanent hole for affected enterprises.
• Network Lateral Movement: The Slican runs a modified Linux kernel; successful exploitation yields a root shell, giving attackers a foothold on the internal LAN segment to pivot into IT infrastructure.

Detection Guidance

Sigma Rule

title: Slican Modem Authentication Bypass - Unauthorized Debug Session
id: 64f3b2b2-6ab1-4b3a-9d1a-2b3f0a4f0a1a
status: experimental
description: Detects a successful authentication bypass on Slican exchanges by observing the debug session initiation immediately after a network connection without preceding login.
logsource:
  category: application
  product: slican
detection:
  selection_conn:
    src_ip: "0.0.0.0"  # Relevant for PSTN origin
    event.action: "MODEM_CONNECT"
  selection_debug:
    event.action: "SERVICE_SESSION_START"
  selection_session:
    event.action: "SHELL_ACCESS"
  timeframe: 5s
  condition: selection_conn and selection_debug and selection_session
  # Selection criteria: A session is established without a corresponding AUTH_SUCCESS event.
  filter:
    event.action: "AUTH_SUCCESS"
level: critical
tags:
  - attack.public_application
  - attack.t1190

YARA Rule

rule SUSPICIOUS_SLICAN_SERVICE_PROTOCOL
{
    meta:
        author = "ValtersIT SOC"
        description = "Detects suspicious Slican service protocol traffic containing debug shell commands over Telnet sessions"
        date = "2026-02-10"
    strings:
        $s1 = "SVC_" ascii nocase
        $s2 = "DEBUG" ascii nocase
        $s3 = "get_conf" ascii nocase
        $s4 = "put_conf" ascii nocase
        $s5 = "!SHELL" ascii
        $s6 = "ROOT" ascii wide ascii
        $p1 = { 0x02 0xFF 0x0D 0x0A }  // Possible binary service protocol magic bytes
    condition:
        ( uint16(0) == 0x0122 and any of ($s*) ) or all of them
}

Suricata IDS Rule

alert tcp any any -> any 2323 (msg:"ET EXPLOIT Slican Telephone Exchange Modem Service Protocol Authentication Bypass Attempt"; flow:established,to_server; content:"SVC_"; offset:0; depth:4; content:"DEBUG"; within:100; content:"CONF"; within:100; sid:20263509; rev:1; metadata:attack_target Networking_Equipment, created_at 2026_02_10, deployment Perimeter, signature_severity Critical, tag auth_bypass;)

Elastic Detection

sequence by host.name with maxspan=10s
  [ network where event.type == "start" and destination.port == 2323 and process.name == "telnetd" ]
  [ process where process.name == "sh" and event.action == "exec" and command_line == "sh -i" ]

Splunk SPL Query

index=network sourcetype=cisco:asa
| search "MODEM_CONNECT"
| join type=inner src_ip
    [ search index=main sourcetype=linux:syslog
      | search "service_session_started" OR "shell_access"
      | rename src_ip AS src_ip_session ]
| eval attack_success=if(src_ip_session != "unknown", "YES", "NO")
| stats count by attack_success, dest_ip

Wazuh OSSEC Rule

<group name="slican,">
    <rule id="201350" level="14">
        <decoded>alert</decoded>
        <match>MODEM_ACCESS</match>
        <match>NO_AUTH</match>
        <description>Slican Exchange: Modem connection with no authentication. Potential CVE-2026-35090 exploitation.</description>
        <group>authentication_failed,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (No patch evidence from any tracked source for EOL versions; vendor provided fixes only for non-EOL hardware).

1. Immediate Mitigations (No Patch Available for EOL Devices)

• Disconnect Modems: Physically disconnect the analog/ISDN modem port on the Slican exchange if remote dial-in management is not strictly required. This is the highest priority action to eliminate the attack vector.
• Caller ID Blocking: If disconnection is impossible, coordinate with the telecom carrier to block incoming PSTN calls that present a Caller ID (CLI) matching the vendor's internal diagnostic number, or set the exchange to reject all calls with no CLI or foreign CLIs.
• Network Segmentation: Move the Slican exchange off the main LAN and place it on an isolated VLAN with no routing to the corporate IT network. Block all outbound access from the exchange except for SIP traffic to the VoIP provider.

2. Patch/Upgrade Steps (Supported Hardware Only)

• Non-EOL Devices: If your system is IPL-256, IPM-032, or newer CCT-1668/MAC-6400/CXS-0424 models, upgrade to the patched firmware versions:
  • IPL-256 ≥ 6.61.0040
  • IPM-032 ≥ 6.61.0040
  • CCT-1668 ≥ 6.56.0430
  • MAC-6400 ≥ 6.56.0430
  • CXS-0424 ≥ 6.30.0510
• Obtain Firmware: Contact Slican technical support (or your reseller) to request the firmware binaries. Verify SHA-256 checksums provided by Slican to ensure integrity before applying.

3. Long-Term Hardening (EOL Hardware)

• Hardware Replacement: CCT-1668(CPU1), MAC-6400, and CXS-0424 devices are End-of-Life (discontinued in 2011/2012) and cannot be patched. These devices require a hardware upgrade to a current Slican platform or a competing product.
• Decommissioning: Plan a phased replacement project immediately. While the device is in service, operate it on an isolated network segment with strict egress filtering.
• Monitoring: If sunsetting is delayed, implement 24/7 monitoring of the PSTN line and SIP trunk logs for unusual modem connection attempts (e.g., calls outside business hours, multiple failed handshakes). Deploy the detection rules above.
• Vendor Engagement: Contact Slican's service department directly regarding your specific EOL hardware to determine available upgrade paths and discounts.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-35090 (Incoming; CVE-ID published by CERT-PL).
2. Vendor Advisory (CERT-PL): Vulnerability note released via Polish CERT (CERT.PL) regarding Slican telephone exchanges; direct URL pending confirmation. Contact Slican service department for official bulletin.
3. CWE-288: https://cwe.mitre.org/data/definitions/288.html — Authentication Bypass Using an Alternate Path or Channel.
4. Slican Vendor Portal: https://www.slican.com — For download links and hardware upgrade information (login required).
5. EPSS Data (FIRST): EPSS score 0.00625 (46.5% percentile), indicating low exploit probability in the wild currently. CISA KEV lists this as NOT exploited.