CVE-2026-35089 describes a vulnerability in Slican IPx telephone exchanges where the secure key generation process is predictable due to reliance on device properties accessible without authentication. This weakness enables an unauthenticated attacker to deduce the secure key and obtain administrative credentials. The issue has been addressed in versions 6.61.0040 for the IPx series, 6.56.0430 for CCT-1668 and MAC-6400, and 6.30.0510 for CXS-0424. However, end-of-life devices running versions 4.xx and below remain vulnerable and will not receive patches due to hardware and software discontinuation.

An unauthenticated attacker can deduce the secure key and gain administrative access to affected Slican telephone exchanges. This compromises the confidentiality and integrity of the device, potentially allowing full control over the telephone exchange. The vulnerability has a high CVSS 4.0 score of 8.7, indicating significant risk if exploited. End-of-life devices remain vulnerable without available patches.

Fixes are available in the specified updated versions of the affected products. Users should upgrade to these fixed versions to remediate the vulnerability. For end-of-life devices that cannot be updated due to hardware discontinuation, the vendor recommends contacting their service department to explore upgrade options. Patch status is not explicitly stated but implied by version fixes; users should verify with the vendor for current remediation guidance.