CVE-2026-35087 is an authentication bypass vulnerability (CWE-288) in Slican IPx telephone exchanges that allows an attacker to circumvent administrative protocol authentication by executing a specific command, thus bypassing login credentials. The vulnerability affects multiple Slican products, with fixed versions released for supported models (NCP 1.24.0250, IPx 6.61.0040, CCT-1668 6.56.0430, MAC-6400 6.56.0430, CXS-0424 6.30.0510). However, End-Of-Life devices (CCT-1668, MAC-6400, CXS-0424 versions 4.xx and below) remain vulnerable and cannot be patched without hardware upgrades. The CVSS 4.0 vector indicates the vulnerability is remotely exploitable without privileges or user interaction, with high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to bypass administrative authentication controls, potentially gaining unauthorized administrative access to the telephone exchange system. This could lead to unauthorized configuration changes or disruption of telephony services. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, reflecting the ease of exploitation and high impact on system security. No public exploits have been reported yet.

Fixed versions are available for supported Slican products as listed: NCP version 1.24.0250, IPx series version 6.61.0040, CCT-1668 version 6.56.0430, MAC-6400 version 6.56.0430, and CXS-0424 version 6.30.0510. Users should upgrade to these versions to remediate the vulnerability. For End-Of-Life devices (CCT-1668, MAC-6400, CXS-0424 versions 4.xx and below), which are no longer supported and require hardware upgrades for software updates, the vendor recommends contacting their service department to explore upgrade options. Patch status for these legacy devices is effectively no longer available. No other mitigations or vendor advisories indicating alternative mitigations were provided.