The vulnerability CVE-2026-35090 affects Slican telephone exchanges, allowing an attacker to bypass authentication by calling the modem with a specific caller ID. This grants full access to the service protocol and configuration panel remotely. The flaw is independent of configuration and can enable remote access if disabled. Fixed versions exist for multiple products, including CCT-1668 version 6.56.0430 and later. However, End-Of-Life products such as CCT-1668 (CCT1CPU) versions 4.xx and below remain vulnerable and unsupported. These legacy devices require hardware upgrades to receive software patches.

An unauthenticated attacker can gain full administrative access to the telephone exchange's service protocol and configuration panel remotely, potentially allowing complete control over the device. This could lead to unauthorized configuration changes and disruption of telephone exchange operations. The vulnerability is critical with a CVSS 4.0 score of 9.3, indicating high exploitability and impact. Legacy devices without available patches remain at risk.

Fixed versions are available for supported products: IPL-256 and IPM-032 version 6.61.0040 or later, CCT-1668 and MAC-6400 version 6.56.0430 or later, and CXS-0424 version 6.30.0510 or later. Users should upgrade to these versions to remediate the vulnerability. For End-Of-Life devices (CCT-1668, MAC-6400, CXS-0424 versions 4.xx and below), no software patches are available. The vendor recommends contacting their service department to explore hardware upgrade options. Patch status is not explicitly stated in the advisory for all products, but fixed versions are identified. No known exploits are reported in the wild.