{"id":"CVE-2026-63315","title":"WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext","summary":"WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.\n\n\n\nThis issue was fixed i…","severity":"high","cvss":8.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-256"],"vendor":"Slican","product":"IPx","affected":["IPx < 6.62.0100"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T14:17:26.880","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63315","references":[{"url":"https://cert.pl/posts/2026/08/CVE-2026-63314","label":"cvd@cert.pl"},{"url":"https://www.slican.pl/oferta/oprogramowanie/aplikacje-cti/webcti-dla-abonenta/","label":"cvd@cert.pl"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T13:47:18.423474Z"},"cvssSource":"cna","ingestedAt":"2026-10-15T09:59:33.279Z","slug":"CVE-2026-63315","body":"## Overview\n\nWebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.\n\n\n\nThis issue was fixed in IPx series version 6.62.0100.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}