Remote Access Vulnerability in Slican Telephone Exchanges

CVE-2026-35090

What is CVE-2026-35090?

A significant vulnerability exists within Slican telephone exchanges, permitting unauthorized remote management through the control panel. Attackers can exploit this flaw by utilizing a specific caller ID to connect to the modem and bypass administrative authentication. This grants them full access to the service protocol and configuration panel, independent of the device’s configuration settings. Notably, if remote access is disabled, using the designated caller ID can temporarily reactivate it. Users of outdated, end-of-life telephone exchanges (versions 4.xx and below), which ceased support in 2011 and 2012, face heightened security risks, as these devices will not receive necessary updates. A hardware upgrade is needed to secure future software updates, and users are encouraged to reach out to Slican’s service department for upgrade options.

References