Slican telephone exchanges allow an unauthenticated attacker to connect to the modem through a telephone call that uses a specific caller ID. By doing so, the attacker bypasses the admin authentication mechanism and obtains full control over the service protocol and configuration panel. This flaw is independent of the device's current configuration and, if remote access is disabled, the special caller ID temporarily re‑enables it. The vulnerability is a classic access control bypass (CWE‑288), enabling an attacker to read, modify, and potentially disrupt the device's operations.

The flaw affects several Slican products: the CCT‑1668, CXS‑0424, IPL‑256, IPM‑032, and MAC‑6400 series. Firmware versions prior to the fixed revisions are vulnerable. Fixed firmware versions are: IPL‑256 and IPM‑032 earlier than 6.61.0040, CCT‑1668 and MAC‑6400 earlier than 6.56.0430, and CXS‑0424 earlier than 6.30.0510. End‑of‑life devices running 4.xx and earlier—CCT‑1668 (CCT1CPU), MAC‑6400, and CXS‑0424—remain vulnerable and will not receive updates; a hardware upgrade is required to receive patched software.

With a CVSS score of 9.3 the flaw is considered critical. The EPSS score is not available, but the vulnerability can be leveraged over the public telephone network by an attacker who knows the special caller ID; no network connectivity or privileged credentials are required. The flaw is not listed in CISA’s KEV catalog, which suggests no known widespread exploitation yet. Nonetheless, because remote access is re‑enabled by the attack, any complicit user could potentially misconfigure the device or install malicious firmware, so immediate remediation is advised.