Executive Summary

CVE-2025-14577 is a vulnerability affecting multiple Slican devices, including models NCP, IPL, IPM, and IPU. It allows an unauthenticated remote attacker to execute arbitrary PHP commands by sending specially crafted requests to the /webcti/session_ajax.php endpoint. This is due to a PHP Function Injection flaw, classified under CWE-306: Missing Authentication for Critical Function.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a severe impact as it allows an unauthenticated attacker to remotely execute arbitrary PHP commands on affected Slican devices. This could lead to full compromise of the device, unauthorized access to sensitive information, disruption of services, or further attacks within the network.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for unauthorized or suspicious HTTP requests sent to the /webcti/session_ajax.php endpoint on Slican NCP/IPL/IPM/IPU devices.'}, {'type': 'paragraph', 'content': 'One way to detect potential exploitation attempts is to capture and analyze network traffic for specially crafted requests targeting this endpoint.'}, {'type': 'paragraph', 'content': "For example, you can use the following command with curl to test if the endpoint is vulnerable by sending a crafted request (replace <device_ip> with the target device's IP address):"}, {'type': 'list_item', 'content': "curl -v http://<device_ip>/webcti/session_ajax.php -d 'payload_here'"}, {'type': 'paragraph', 'content': 'Additionally, using network monitoring tools like tcpdump or Wireshark to filter HTTP requests to /webcti/session_ajax.php can help identify suspicious activity.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the affected Slican devices to the fixed versions: 1.24.0190 for Slican NCP and 6.61.0010 for Slican IPL/IPM/IPU.

Until the upgrade can be applied, restrict access to the /webcti/session_ajax.php endpoint by implementing network-level controls such as firewall rules to block unauthorized external access.

Also, monitor logs and network traffic for any suspicious requests targeting this endpoint to detect potential exploitation attempts.

Useful 0 Not Useful 0