CVE-2026-63315 PUBLISHED

Plaintext storage of a password in WebCTI

Assigner: CERT-PL
Reserved: 16.07.2026 Published: 15.10.2026 Updated: 15.10.2026

WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.

This issue was fixed in IPx series version 6.62.0100.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.2

Product Status

Vendor Slican
Product IPx
Versions Default: unaffected
  • affected from 0 to 6.62.0100 (excl.)

Credits

  • Damian Strojek finder
  • Olha Zozulia finder

References

Problem Types

  • CWE-256 Plaintext storage of a password CWE