← Database

CVE-2025-14577

CRITICAL CVSS: 9.8 Published: 2026-02-24 Modified: 2026-06-17

Description

Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/session_ajax.php endpoint. This issue was fixed in version 1.24.0190 (Slican NCP) and 6.61.0010 (Slican IPL/IPM/IPU).

Affected Platforms

Slican Ncp Server Cm600P.1BcSlican Ipl-256.3USlican Ncp FirmwareSlican Ipm-032 FirmwareSlican Ipm-032.2USlican Ncp Server Cm300P.1BcSlican Ipm-032.WmSlican Ipu-14.105.1USlican Ipu-14 FirmwareSlican Ipu-14.103.Wm

Weakness Type

CWE-306

References