CVE-2026-35088 Inadequate Encryption Strength in Slican telephone exchanges
Attackers with access to binary files can decrypt TCP/IP communications due to hardcoded symmetric encryption keys in Slican telephone exchanges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-35088?
CVE-2026-35088 is a high-severity vulnerability in Slican CCT-1668, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication.
This issue was fixed in IPx series version 6.62.0100.
The issue STILL EXISTS in End-Of-Life telephone exchanges: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.
Weakness: CWE-326
Which versions are affected by CVE-2026-35088?
How do I fix CVE-2026-35088?
No fix has been published for CVE-2026-35088 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-35088 being exploited?
There is no known exploitation of CVE-2026-35088 in the wild and no public exploit code.
Sources
Also known as GHSA-wfcf-hvq2-76r6.