Key points
- CVE-2026-63315 affects Slican IPx systems running versions prior to 6.62.0100.
- The National Vulnerability Database rates the issue as high severity with a score of 8.2.
- Attackers with database access can retrieve plain-text passwords and hijack subscriber accounts.
Slican has released version 6.62.0100 for its IPx series telephone exchanges to address a data protection failure. This update resolves CVE-2026-63315, a flaw that allowed temporary subscriber passwords to be stored in plain text within the system database. Organizations running older versions of the IPx software remain exposed to this specific risk until they apply the vendor-provided patch.
In plain English
The WebCTI service included in Slican IPx telephone exchanges failed to encrypt temporary passwords for subscribers. Instead of storing these credentials in a secure, unreadable format, the system saved them as plain text. If an attacker gains access to the underlying database, they can read these passwords directly. This allows the attacker to log into the subscriber accounts using the stolen credentials without needing to crack or guess the passwords.
The background
The National Vulnerability Database lists CVE-2026-63315 with a CVSS score of 8.2, classifying it as a high-severity vulnerability. The flaw is categorized under CWE-256, which relates to plain-text storage of sensitive information. The issue specifically impacts Slican IPx systems running any version before 6.62.0100. The security weakness stems from how the WebCTI service handles temporary authentication data for telephone subscribers.
What changes now
Slican has confirmed that version 6.62.0100 fixes the plaintext storage issue for the IPx series. Users must upgrade to this specific version to resolve the vulnerability. Systems remaining on older builds will continue to store subscriber passwords in a readable format within the database. The source material states that this issue was fixed in IPx series version 6.62.0100.
Who needs to act first
Teams usually prioritize systems with direct database exposure or those handling sensitive subscriber data. Check whether your IPx instances are accessible to internal networks or third-party integrations. Roll out the version update in a controlled manner, testing functionality in a non-production environment first. Back up existing configurations before applying changes. Ensure that all administrative accounts are rotated after the patch to mitigate any prior exposure.
What to do and how to stay safe: Slican
- Verify your current Slican IPx version and compare it against the fixed release 6.62.0100.
- Restrict database access to the WebCTI service to limit the attack surface immediately.
- Monitor logs for unauthorized access attempts to subscriber accounts or database queries.
- Plan a maintenance window to deploy the vendor update once the patch is available.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Slican products are affected by CVE-2026-63315?
The vulnerability affects Slican IPx telephone exchanges running versions prior to 6.62.0100.
Is there a fix available for this plaintext password issue?
Yes, Slican released version 6.62.0100 for the IPx series to resolve the vulnerability.
How severe is this vulnerability according to the National Vulnerability Database?
The NVD rates CVE-2026-63315 as high severity with a CVSS score of 8.2.
