CVE-2025-14577 — PHP Function Injection in Slican NPC/IPL/IPM/IPU

CVE-2025-14577

PHP Function Injection in Slican NPC/IPL/IPM/IPU PUBLISHED

Description (CNA)

Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/session_ajax.php endpoint. This issue was fixed in version 1.24.0190 (Slican NCP) and 6.61.0010 (Slican IPL/IPM/IPU).

Affected (CNA)

Vendor / product	Versions
Slican / NCP	affected 0 before 1.24.0190
Slican / IPL	affected 0 before 6.61.0010
Slican / IPM	affected 0 before 6.61.0010
Slican / IPU	affected 0 before 6.61.0010

CWE

CWE-306

References

https://cert.pl/posts/2026/02/CVE-2025-14577
https://www.slican.pl/oferta/centrale-telefoniczne/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.