CVE-2025-14577 PHP Function Injection in Slican NPC/IPL/IPM/IPU
Unauthenticated remote attackers can execute arbitrary PHP commands on Slican network devices via a vulnerable endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14577?
CVE-2025-14577 is a critical code injection vulnerability in Slican IPL, published on 24 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/session_ajax.php endpoint.
This issue was fixed in version 1.24.0190 (Slican NCP) and 6.61.0010 (Slican IPL/IPM/IPU).
Weakness: CWE-306
Which versions are affected by CVE-2025-14577?
It affects 4 products.
Products include Slican Ipl-256 Firmware, Slican Ipm-032 Firmware, Slican Ipu-14 Firmware, Slican Ncp Firmware.
How do I fix CVE-2025-14577?
No fix has been published for CVE-2025-14577 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-14577 being exploited?
There is no known exploitation of CVE-2025-14577 in the wild and no public exploit code.
Sources
Also known as GHSA-266v-99c5-7x8c.