External risk intelligence

Slican Telephone Exchange Administrative Protocol Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-35087

This vulnerability affects Slican telephone exchanges, which are networking infrastructure devices often deployed to facilitate communications. As administrative interfaces for such appliances are frequently accessible over the network to manage telephony services, they are considered public-facing or edge-adjacent by design in common deployment patterns.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Slican telephone exchanges that allows unauthorized access by bypassing authentication protocols. Exploitation could lead to significant compromise of the affected communication systems. While newer versions have been patched, older, unsupported End-of-Life models remain vulnerable and require a hardware upgrade for remediation. The main concern is confirming relevance and exposure for these older systems.

Bypasses login to critical phone systems.
Affects older, unpatched communication infrastructure.
Confirm relevance and exposure for legacy systems.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication on Slican telephone exchanges by sending a specific command, potentially allowing unauthorized access to administrative functions. This vulnerability could lead to a compromise of the telephone exchange's control and internal network.

No authentication required to initiate.
Triggered by sending a specific administrative command.
Risk: Administrative access and control compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass login credentials on Slican telephone exchanges by executing a specific command, potentially impacting administrative control over telephony services when supported by the advisory.

Affects administrative control of telephone exchanges.
Bypasses authentication through command execution.
Unauthorized access to system configuration.

Operational Fix

Recommended remediation, mitigation, and detection steps

Telephony infrastructure owners and network security teams are responsible for managing Slican telephone exchanges. The first step is to identify all deployed exchange hardware, confirm network exposure and business criticality, and then locate the accountable system owner for remediation planning.

Identify affected hardware and exposure.
Confirm responsible system ownership.
Coordinate vendor upgrade options.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is a Slican telephone exchange?

A Slican telephone exchange is a specialized networking appliance that manages and routes voice communications within an organization. These systems serve as the core infrastructure for telephony services, handling incoming and outgoing calls, internal extensions, and call routing configuration.

What does CWE-288 mean for CVE-2026-35087?

CWE-288 identifies an authentication bypass weakness. In this specific case, the vulnerability allows an attacker to interact with the device's administrative functions without providing valid login credentials. Essentially, the system fails to properly verify the identity of the user requesting access, granting them the ability to issue commands as if they were an authorized administrator.

How is this authentication bypass triggered?

The bypass occurs when a specific administrative command is sent to the device over the network. Because the vulnerability lies within the authentication protocol itself, no special conditions or prior access levels are required to initiate the request. The system simply processes the command without checking for a password, though the bug does not affect general call-handling functions that do not require administrative privileges.

Is my Slican equipment at risk?

According to Halo Surface Signal, these devices are often deployed as critical communications infrastructure with administrative interfaces frequently accessible over the network. If your exchange is reachable via your network, it may be considered edge-adjacent. You should prioritize checking any units accessible from broader network segments, as these are the most likely targets for this type of network-based authentication bypass.

How do I secure my Slican telephone exchange?

Begin by auditing your network to identify all deployed hardware models and their specific firmware versions. If you are running supported hardware, verify if your version requires an update to the latest release provided by the vendor. For End-Of-Life units that cannot be updated via software, you must contact the vendor’s service department to discuss necessary hardware upgrade paths to mitigate the risk.

References

cert.pl/posts/2026/05/CVE-2026-35087

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.