CVE-2026-35088
Received Received - Intake

Hardcoded Encryption Key in Slican Telephone Exchanges

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: CERT.PL

Description
Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication. This issue was fixed in IPx series version 6.62.0100. The issue STILL EXISTS in End-Of-Life telephone exchanges: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-35088
EUVD
EUVD-2026-101950

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Slican IPx 0
Slican CCT-1668 0
Slican MAC-6400 0
Slican CXS-0424 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-326 The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Slican telephone exchanges using weak symmetric encryption for TCP/IP communication. The encryption key is hardcoded in multiple binary files, allowing attackers with access to decrypt all communications.

Detection Guidance

Detecting this vulnerability requires checking for hardcoded encryption keys in binary files of Slican telephone exchanges. Inspect binary files in the system for known hardcoded keys or patterns. Use tools like strings or hex editors to analyze binary files for embedded secrets. Network traffic analysis may also reveal unencrypted or weakly encrypted TCP/IP communications.

Impact Analysis

An attacker could intercept and decrypt sensitive phone communications, leading to unauthorized access to confidential information. This is especially critical for organizations using affected models like CCT-1668, MAC-6400, or CXS-0424.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and encryption standards in GDPR and HIPAA, as it exposes sensitive communications to unauthorized decryption. Organizations using affected systems may face regulatory penalties.

Mitigation Strategies

For IPx series, upgrade to version 6.62.0100 or later. For EOL models CCT-1668, MAC-6400, and CXS-0424, contact Slican's service department for hardware upgrade options. Isolate affected devices from critical network segments to limit exposure. Monitor network traffic for suspicious decryption attempts or unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-35088. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart