CVE-2026-63315

WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account. This issue was fixed in IPx series version 6.62.0100.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/posts/2026/08/CVE-2026-63314
https://www.slican.pl/oferta/oprogramowanie/aplikacje-cti/webcti-dla-abonenta/

Configurations

No configuration.

History

15 Oct 2026, 09:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-15 09:17

Updated : 2026-10-16 20:04

NVD link : CVE-2026-63315

Mitre link : CVE-2026-63315

CVE.ORG link : CVE-2026-63315

JSON object : View

Products Affected

No product.

CWE

CWE-256

Plaintext Storage of a Password

{"id": "CVE-2026-63315", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63315", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T13:47:18.423474Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "Slican", "modules": ["WebCTI"], "product": "IPx", "versions": [{"status": "affected", "version": "0", "lessThan": "6.62.0100", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-15T09:17:17.857", "references": [{"url": "https://cert.pl/posts/2026/08/CVE-2026-63314", "source": "cvd@cert.pl"}, {"url": "https://www.slican.pl/oferta/oprogramowanie/aplikacje-cti/webcti-dla-abonenta/", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-256"}]}], "descriptions": [{"lang": "en", "value": "WebCTI service for Slican IPx telephone exchanges\u00a0stores\u00a0temporary subscriber password in plaintext. An attacker with\u00a0access to the database can obtain the user's password and log in to the subscriber's account.\n\n\n\nThis issue was fixed in IPx series version 6.62.0100."}], "lastModified": "2026-10-16T20:04:29.760", "sourceIdentifier": "cvd@cert.pl"}

CVE-2026-63315

JSON object

Attach tags to CVE-2026-63315

Attach tags to `CVE-2026-63315`