CVE-2026-63315 Plaintext storage of a password in WebCTI
Attackers with database access can retrieve plaintext subscriber passwords from WebCTI, enabling unauthorized account access on Slican IPx exchanges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63315?
CVE-2026-63315 is a high-severity vulnerability in Slican IPx, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.
This issue was fixed in IPx series version 6.62.0100.
Weakness: CWE-256
Which versions are affected by CVE-2026-63315?
How do I fix CVE-2026-63315?
Upgrade to a fixed version.
Is CVE-2026-63315 being exploited?
There is no known exploitation of CVE-2026-63315 in the wild and no public exploit code.
Sources
Also known as GHSA-5wrq-xqgm-w7qw.