{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63315", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-07-16T12:42:37.683Z", "datePublished": "2026-10-15T09:00:45.702Z", "dateUpdated": "2026-10-15T13:47:26.220Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-10-15T09:00:45.702Z"}, "title": "Plaintext storage of a password in WebCTI", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-256", "description": "CWE-256 Plaintext storage of a password", "type": "CWE"}]}], "affected": [{"vendor": "Slican", "product": "IPx", "modules": ["WebCTI"], "versions": [{"status": "affected", "version": "0", "lessThan": "6.62.0100", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:slican:ipx:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "6.62.0100"}]}]}], "descriptions": [{"lang": "en", "value": "WebCTI service for Slican IPx telephone exchanges\u00a0stores\u00a0temporary subscriber password in plaintext. An attacker with\u00a0access to the database can obtain the user's password and log in to the subscriber's account.\n\n\n\nThis issue was fixed in IPx series version 6.62.0100.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "WebCTI service for Slican IPx telephone exchanges&nbsp;stores&nbsp;temporary subscriber password in plaintext. An attacker with&nbsp;access to the database can obtain the user's password and log in to the subscriber's account.<br><div><span><br></span></div><div>This issue was fixed in IPx series version 6.62.0100.</div>"}]}], "references": [{"url": "https://cert.pl/posts/2026/08/CVE-2026-63314", "tags": ["third-party-advisory"]}, {"url": "https://www.slican.pl/oferta/oprogramowanie/aplikacje-cti/webcti-dla-abonenta/", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Damian Strojek", "type": "finder"}, {"lang": "en", "value": "Olha Zozulia", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-15T13:47:18.423474Z", "id": "CVE-2026-63315", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T13:47:26.220Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63315", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T13:47:18.423474Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T13:47:23.481Z"}}], "cna": {"title": "Plaintext storage of a password in WebCTI", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Damian Strojek"}, {"lang": "en", "type": "finder", "value": "Olha Zozulia"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Slican", "modules": ["WebCTI"], "product": "IPx", "versions": [{"status": "affected", "version": "0", "lessThan": "6.62.0100", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.pl/posts/2026/08/CVE-2026-63314", "tags": ["third-party-advisory"]}, {"url": "https://www.slican.pl/oferta/oprogramowanie/aplikacje-cti/webcti-dla-abonenta/", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "WebCTI service for Slican IPx telephone exchanges\u00a0stores\u00a0temporary subscriber password in plaintext. An attacker with\u00a0access to the database can obtain the user's password and log in to the subscriber's account.\n\n\n\nThis issue was fixed in IPx series version 6.62.0100.", "supportingMedia": [{"type": "text/html", "value": "WebCTI service for Slican IPx telephone exchanges&nbsp;stores&nbsp;temporary subscriber password in plaintext. An attacker with&nbsp;access to the database can obtain the user's password and log in to the subscriber's account.<br><div><span><br></span></div><div>This issue was fixed in IPx series version 6.62.0100.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-256", "description": "CWE-256 Plaintext storage of a password"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:slican:ipx:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.62.0100", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-10-15T09:00:45.702Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63315", "state": "PUBLISHED", "dateUpdated": "2026-10-15T13:47:26.220Z", "dateReserved": "2026-07-16T12:42:37.683Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-10-15T09:00:45.702Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["WebCTI"], "product": "IPx", "vendor": "Slican", "versions": [{"lessThan": "6.62.0100", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WebCTI service for Slican IPx telephone exchanges\u00a0stores\u00a0temporary subscriber password in plaintext. An attacker with\u00a0access to the database can obtain the user's password and log in to the subscriber's account.\n\n\n\nThis issue was fixed in IPx series version 6.62.0100."}], "id": "CVE-2026-63315", "lastModified": "2026-10-15T14:17:26.880", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63315", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T13:47:18.423474Z", "version": "2.0.3"}}]}, "published": "2026-10-15T09:17:17.857", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/posts/2026/08/CVE-2026-63314"}, {"source": "cvd@cert.pl", "url": "https://www.slican.pl/oferta/oprogramowanie/aplikacje-cti/webcti-dla-abonenta/"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-256"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{}