We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2025-14577

CVE-2025-14577

PHP

Severity: CRITICAL
CVSS: 9.8CVSS
Published: 2026-02-24
Last modified: 2026-03-02
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-306

Description

Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/session_ajax.php endpoint. This issue was fixed in version 1.24.0190 (Slican NCP) and 6.61.0010 (Slican IPL/IPM/IPU).

References

https://cert.pl/posts/2026/02/CVE-2025-14577
https://www.slican.pl/oferta/centrale-telefoniczne/

Summary

Description

References