---
id: CVE-2026-63315
title: "WebCTI service for Slican IPx telephone exchanges\_stores\_temporary subscriber password in plaintext"
summary: "WebCTI service for Slican IPx telephone exchanges\_stores\_temporary subscriber password in plaintext. An attacker with\_access to the database can obtain the user's password and log in to the subscriber's account.\n\n\n\nThis issue was fixed i…"
severity: high
cvss: 8.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-256
vendor: Slican
product: IPx
affected:
  - IPx < 6.62.0100
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T14:17:26.880'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63315'
references:
  - url: 'https://cert.pl/posts/2026/08/CVE-2026-63314'
    label: cvd@cert.pl
  - url: >-
      https://www.slican.pl/oferta/oprogramowanie/aplikacje-cti/webcti-dla-abonenta/
    label: cvd@cert.pl
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T13:47:18.423474Z'
cvssSource: cna
ingestedAt: '2026-10-15T09:59:33.279Z'
---

## Overview

WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.



This issue was fixed in IPx series version 6.62.0100.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.