Executive Summary

This vulnerability affects Slican telephone exchanges, allowing an unauthenticated attacker to remotely manage the control panel by connecting to the modem via a telephone call with a specific caller ID.

By using this specific caller ID, the attacker can bypass the admin authentication and gain full access to the service protocol and configuration panel.

This bypass works regardless of the telephone exchange's configuration, and even if remote access is disabled, calling with the specific caller ID will temporarily enable it.

The vulnerability has been fixed in newer software versions, but still exists in End-Of-Life devices that are no longer supported and require hardware upgrades for updates.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can gain full administrative access to the telephone exchange's control panel without authentication.

This unauthorized access allows the attacker to modify configurations, potentially disrupt telephone services, intercept or manipulate communications, and compromise the integrity and availability of the system.

Since the vulnerability can temporarily enable remote access even if it is disabled, it increases the risk of remote exploitation.

Devices that are no longer supported and cannot be updated remain vulnerable, posing ongoing security risks.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that your Slican telephone exchange software is updated to the fixed versions or later:

• IPL-256: version 6.61.0040 or later
• IPM-032: version 6.61.0040 or later
• CCT-1668: version 6.56.0430 or later
• MAC-6400: version 6.56.0430 or later
• CXS-0424: version 6.30.0510 or later

For End-Of-Life devices running versions 4.xx and below, which will not receive updates, contact the vendor's service department to explore hardware upgrade options.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an unauthenticated attacker connecting to the modem of Slican telephone exchanges via a telephone call with a specific caller ID to bypass admin authentication. Detection would involve monitoring for unauthorized or suspicious incoming calls with unusual caller IDs that could trigger remote access enabling.

Since the vulnerability is exploited through telephone calls with specific caller IDs, network or system detection commands would focus on telephony logs or modem call logs rather than typical network commands.

No specific detection commands or tools are provided in the available context or resources.

Useful 0 Not Useful 0