Critical · 9.3 CVE-2025-14577 EUVD-2025-208088GHSA-266v-99c5-7x8c

PHP Function Injection in Slican NPC/IPL/IPM/IPU

Published Feb 24, 2026 · Updated Feb 24, 2026 · Assigned by CERT-PL

Vendor: Slican Product: IPL Product: IPM Product: IPU Product: NCP

Description

Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/session_ajax.php endpoint.

This issue was fixed in version 1.24.0190 (Slican NCP) and 6.61.0010 (Slican IPL/IPM/IPU).

Affected products

Vendor	Product	Affected	Fixed
Slican	NCP	< 1.24.0190	1.24.0190
Slican	IPL	< 6.61.0010	6.61.0010
Slican	IPM	< 6.61.0010	6.61.0010
Slican	IPU	< 6.61.0010	6.61.0010

References

https://cert.pl/posts/2026/02/CVE-2025-14577 third-party-advisory
https://www.slican.pl/oferta/centrale-telefoniczne/ product