CVE-2026-35088
8.2HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-326
Impact
Attackers can intercept and decrypt TCP/IP communication on vulnerable telephone exchanges. They need access to binary files containing the hardcoded key to decrypt network traffic.
Root cause
Symmetric encryption keys for TCP/IP network traffic are hardcoded directly into multiple binary files.
Affected systems
Slican IPx series prior to 6.62.0100, and end-of-life models CCT-1668 (CCT1CPU), MAC-6400, and CXS-0424.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade IPx series PBXs to version 6.62.0100 or newer. Discontinued hardware (CCT-1668, MAC-6400, CXS-0424) will not receive patches; isolate their network traffic on dedicated, access-controlled VLANs or replace the hardware.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication. This issue was fixed in IPx series version 6.62.0100. The issue STILL EXISTS in End-Of-Life telephone exchanges: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.