Symmetric Encryption Vulnerability in Slican Telephone Exchanges

CVE-2026-35088

What is CVE-2026-35088?

Slican telephone exchanges employ symmetric encryption for TCP/IP communication, utilizing a hardcoded secret key embedded in multiple binary files. This design flaw allows an attacker with access to these binaries to decrypt potentially sensitive communications. While this issue was resolved in the IPx series version 6.62.0100, it remains a concern for older, End-Of-Life models such as the CCT-1668, MAC-6400, and CXS-0424, which were discontinued in 2011 and 2012 and are not eligible for software updates. Users of these outdated devices are advised to contact Slican's service department to discuss hardware upgrade options.

References