Slican telephone exchanges employ symmetric encryption for TCP/IP communication, but the secret key is hard‑coded in multiple binary files. An attacker who obtains these files can decrypt the traffic, exposing sensitive information. This flaw is a classic case of CWE‑326, insecure cryptographic storage, and leads directly to confidentiality loss.

Affected products include Slican CCT‑1668, Slican CXS‑0424, Slican IPx, and Slican MAC‑6400. The IPx series received a fix in version 6.62.0100; however, the end‑of‑life devices CCT‑1668, MAC‑6400, and CXS‑0424, discontinued in 2011 and 2012, remain vulnerable and require a hardware upgrade to apply the patch.

The CVSS score of 8.2 indicates high severity, but the EPSS score of less than 1% reflects a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require access to the device binaries, either through physical possession or a compromise that allows file retrieval, making the attack vector likely local or requiring privileged access. The risk is therefore high in the presence of such access, but operational risk in typical environments is moderate because of the low likelihood of exploitation.