CVE-2026-63314

8.7High

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.7High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-89

Impact

Authenticated attackers can read, modify, or destroy database records via the WebCTI service. They need network access to the PBX management interface and valid low-privilege user credentials.

Root cause

Improper input neutralization allows SQL injection in the /webcti/admin_json.php endpoint.

Affected systems

Slican IPx series firmware before version 6.62.0100.

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade Slican IPx firmware to version 6.62.0100 or later. If upgrading immediately is not possible, restrict network access to the WebCTI administrative interface to trusted management subnets or disable the WebCTI service.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks. This issue was fixed in IPx series version 6.62.0100.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-63314