NCP vulnerabilities

2 known vulnerabilities in NCP from Slican. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.3 Critical severity

  IPx: Authentication Bypass Using an Alternate Path or Channel

  CVE-2026-35087May 27, 2026Slican

  Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter login credentials by executing the appropriate command. This issue was fixed in versions below: - NCP: version 1.24.0250 - IPx series: vers

• 9.8 Critical severity

  NCP: Missing Authentication for Critical Functionality

  CVE-2025-14577Feb 24, 2026Slican

  Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/session_ajax.php endpoint. This issue was fixed in version 1.