Slican NCP/IPL/IPM/IPU devices allow unauthorized PHP code execution.

Summary

Some Slican NCP, IPL, IPM, and IPU devices can be tricked into running malicious PHP code from the internet. This can happen if an attacker sends a specially crafted request to the device's web interface. If you use one of these devices, you should update to the latest version to prevent this risk.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
slican	ncp_firmware	<= 1.24.0190	–
slican	ipl-256_firmware	<= 6.61.0010	–
slican	ipm-032_firmware	<= 6.61.0010	–
slican	ipu-14_firmware	<= 6.61.0010	–

Original title

Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webct...

Original description

Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/session_ajax.php endpoint.

This issue was fixed in version 1.24.0190 (Slican NCP) and 6.61.0010 (Slican IPL/IPM/IPU).

nvd CVSS3.1 9.8

nvd CVSS4.0 9.3

Vulnerability type

CWE-306 Missing Authentication for Critical Function

https://cert.pl/posts/2026/02/CVE-2025-14577 Third Party Advisory
https://www.slican.pl/oferta/centrale-telefoniczne/ Product