The WebCTI service for Slican IPx telephone exchanges stores temporary subscriber passwords in plaintext, a flaw that fits CWE‑256. Because the passwords are not encrypted or hashed, anyone who obtains access to the database can read the credentials and then log into the subscriber’s account, enabling further exploitation or abuse of the service. The vulnerability does not directly allow arbitrary code execution or denial of service, but the consequent credential compromise provides a strong foothold for attackers.

Affected systems: The flaw exists in the WebCTI component of the Slican IPx telephone exchanges. All versions prior to 6.62.0100 are impacted; the issue was fixed in the 6.62.0100 release. Administrators should verify that their deployed IPx platform is not older than the patched version.

With a CVSS score of 8.2, the vulnerability is classified as high severity. The EPSS score is listed as less than 1 %, suggesting that, at the time of analysis, specific exploitation appears unlikely but is not impossible. Because the flaw requires only database access, an attacker who has compromised the database or bypassed authentication could immediately retrieve passwords without additional privileges. The vulnerability is not currently listed in CISA’s KEV catalog, indicating it has not yet been observed in widespread exploitation. Nonetheless, the potential damage from credential theft warrants rapid remediation.