Remote Code Execution Vulnerability in Slican Communication Devices
CVE-2025-14577

9.3CRITICAL

Key Information:

Vendor

Slican

Status
Ncp
Ipl
Ipm
Ipu
Vendor
CVE Published:
24 February 2026

What is CVE-2025-14577?

Slican NCP/IPL/IPM/IPU devices are at risk of PHP Function Injection, allowing unauthenticated remote attackers to execute arbitrary PHP commands. This vulnerability is exploited by sending specially crafted requests to the /webcti/session_ajax.php endpoint, posing significant security threats to affected systems. The issue has been addressed in Slican NCP version 1.24.0190 and IPL/IPM/IPU version 6.61.0010, enabling users to safeguard their devices and improve overall security.

Affected Version(s)

IPL 0 < 6.61.0010

IPM 0 < 6.61.0010

IPU 0 < 6.61.0010

References

https://cert.pl/posts/2026/02/CVE-2025-14577
third-party-advisory
https://www.slican.pl/oferta/centrale-telefoniczne/
product

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dariusz Gońda
.