CVE-2025-14577 is a critical (9.8) unauthenticated PHP function injection in Slican NCP, IPL, IPM and IPU telephony devices. A crafted request to the session_ajax.php endpoint can run PHP commands. The record says it is fixed in 1.24.0190 for NCP and 6.61.0010 for IPL, IPM and IPU. Update and restrict access.
What's affected
The record lists Slican NCP, IPL, IPM and IPU devices, including models such as IPL-256, IPM-032 and IPU-14. It says the issue was fixed in version 1.24.0190 for Slican NCP and 6.61.0010 for Slican IPL, IPM and IPU.
The CERT Polska summary words the vulnerable range as up to and including those same numbers. That wording looks inconsistent with a fix in the same version, so confirm the exact fixed build with Slican before you rely on it.
The vulnerable endpoint is /webcti/session_ajax.php. The CVSS vector is AV:N/AC:L/PR:N/UI:N, rated high on all impact measures. CERT Polska published the advisory on 24 February 2026 and credits Dariusz Gonda for the report. It lists no workaround.
How to check if you're exposed
Check the device firmware.
- Sign in to the device administration interface and read the firmware version.
- Compare it to the fixed versions above and to the vendor advice.
- Check whether the web interface, especially the webcti component, is reachable from the internet or from user networks.
- Review web logs for requests to the session_ajax.php path from addresses that are not your users.
What to do now
- Inventory every Slican NCP, IPL, IPM and IPU device.
- Update to the fixed firmware, after confirming the exact version with Slican.
- Remove internet exposure, and restrict the web interface to the networks that need it.
- Check device configuration for unexpected changes, such as new extensions, forwarding rules or accounts.
- Review call records for unusual outbound calls, since telephony fraud is a common abuse of PBX access.
Why it matters
The weakness is CWE-306, missing authentication for a critical function. The endpoint accepts requests that let a caller choose which PHP function runs, without checking who the caller is.
Phone systems are an attractive target. Control of a PBX can lead to toll fraud, call interception and a foothold in the internal network. These devices tend to sit unpatched for years, so restricting network access is as important as the firmware update.
Quick check
Is the fixed version clear?
The record says fixed in 1.24.0190 and 6.61.0010. The CERT Polska summary also words the vulnerable range as up to those numbers, so confirm the build with the vendor.
Sources
Last reviewed: 19 October 2026.
