CVE-2026-35088 Slican CVE debrief

Who should care

Defenders responsible for End-Of-Life telephone exchanges, specifically those using Slican CCT-1668, MAC-6400, and CXS-0424, should assess exposure and upgrade options. These devices are no longer supported and require hardware updates to receive software fixes. Operators of these systems should verify their exposure, review compensating controls, and plan for potential upgrades or mitigations.

Why it matters

CVE-2026-35088 allows decryption of communication in Slican telephone exchanges with hardcoded encryption keys, impacting End-Of-Life devices. Defenders should verify exposure, assess upgrade options, and implement compensating controls.

• Decrypting communication may allow eavesdropping or tampering
• Exposure in End-Of-Life devices requires hardware updates or compensating controls
• Verification of decryption risk and mitigation priority is necessary

Technical summary

Slican telephone exchanges use symmetric encryption for TCP/IP communication with a hardcoded secret key in multiple binary files. An attacker with access to these files can decrypt the communication. The issue was fixed in IPx series version 6.62.0100 but remains in End-Of-Life products CCT-1668, MAC-6400, and CXS-0424. This vulnerability allows decryption of communication, potentially enabling eavesdropping or tampering. Defenders should prioritize verifying exposure in End-Of-Life telephone exchanges and assessing upgrade options.

Defensive priority

Defenders should prioritize verifying exposure in End-Of-Life telephone exchanges and assessing upgrade options.

Recommended defensive actions

• Verify exposure in End-Of-Life telephone exchanges
• Assess upgrade options for affected devices
• Implement compensating controls for decryption risk
• Review vendor guidance for patching or mitigating affected systems
• Conduct asset inventory of affected End-Of-Life devices
• Monitor for potential exploitation attempts
• Track remediation progress and verify effectiveness

Evidence notes

The CVE record indicates that Slican telephone exchanges use symmetric encryption with a hardcoded secret key, which can be decrypted by an attacker with access to binary files. The issue was fixed in IPx series version 6.62.0100, but remains in End-Of-Life products.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.