Full Report
Missing Authentication for Critical Function vulnerability (CVE-2025-14577) has been found in in multiple Slican devices.
Analysis Summary
# Vulnerability: Missing Authentication for Critical Function in Slican Devices
## CVE Details
- CVE ID: CVE-2025-14577
- CVSS Score: Not explicitly provided, classified as Missing Authentication for Critical Function.
- CWE: CWE-306 (Missing Authentication for Critical Function)
## Affected Systems
- Products: Slican NCP, IPL, IPM, IPU
- Versions:
- Slican NCP: All versions before 1.24.0190
- Slican IPL/IPM/IPU: All versions before 6.61.0010
- Configurations: Not specified, applies generally to the listed products/versions.
## Vulnerability Description
The vulnerability is due to **PHP Function Injection** present in multiple Slican devices. An unauthenticated remote attacker can exploit this flaw by sending specially crafted requests to the `/webcti/session_ajax.php` endpoint. Successful exploitation allows the attacker to **execute arbitrary PHP commands** on the underlying system.
## Exploitation
- Status: Details regarding exploitation status (in the wild/PoC) are not provided, but the nature of the flaw suggests high exploitability.
- Complexity: Assumed Low, given it requires unauthenticated remote access to a specific endpoint.
- Attack Vector: Network (Remote)
## Impact
- Confidentiality: High (Ability to execute arbitrary code often leads to full system disclosure)
- Integrity: High (Ability to modify system files or configuration)
- Availability: High (Ability to cause denial of service or system compromise)
## Remediation
### Patches
- Slican NCP: Upgrade to version **1.24.0190** or later.
- Slican IPL/IPM/IPU: Upgrade to version **6.61.0010** or later.
### Workarounds
- No specific workarounds were provided in the source document. Network segmentation or strict access control to the affected endpoints may offer partial defense until patching is complete.
## Detection
- Indicators of Compromise (IOC): Look for unusual or unexpected activity originating from or targeting the `/webcti/session_ajax.php` endpoint, especially requests containing command injection payloads.
- Detection methods and tools: Web Application Firewalls (WAFs) configured to monitor for PHP command execution patterns, or network monitoring tools inspecting HTTP traffic to the specified path.
## References
- Vendor advisories: Fixes are bundled in the mentioned versions provided by Slican.
- Relevant links:
- Source Advisory: hxxps://cert.pl/en/posts/2026/02/vulnerability-in-multiple-slican-devices
- CVE Record: hxxps://www.cve.org/CVERecord?id=CVE-2025-14577