CVE-2026-63315CWE-256

CVE-2026-63315

published October 15, 2026

CVSS
8.2
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.

This issue was fixed in IPx series version 6.62.0100.

The record
Technical detail
CVSS
8.2 · NONE
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00288 · 20.2th percentile
Weakness
CWE-256 · Plaintext Storage of a Password
Published
2026-10-15T13:17Z
References (2)
https://cert.pl/posts/2026/08/CVE-2026-63314 · [email protected]https://www.slican.pl/oferta/oprogramowanie/aplikacje-cti/webcti-dla-abonenta/ · [email protected]
EPSS history
Timeline
  • 16 OCT 03:31Z
    EPSS moved — → 0%
    epss
  • 15 OCT 09:00Z
    Plaintext storage of a password in WebCTI
    cvelistv5
  • 15 OCT 09:00Z
    Plaintext storage of a password in WebCTI
    cvelistv5