Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Feb 24, 2026 · NIST NVD

   Detected

   Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/session_ajax.php endpoint. This issue was fixed in version 1.24.0190 (Slican NCP) and 6.61.0010 (Slican IPL/IPM/IPU).

2. Jun 17, 2026 · NIST NVD

   Updated

   Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/session_ajax.php endpoint. This issue was fixed in version 1.24.0190 (Slican NCP) and 6.61.0010 (Slican IPL/IPM/IPU).

Affected

• cpe slican/ipl-256 firmwareversion unspecified
• cpe slican/ipm-032 firmwareversion unspecified
• cpe slican/ipu-14 firmwareversion unspecified
• cpe slican/ncp firmwareversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-14577

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-14577

  Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/session_ajax.php endpoint. This issue was fixed in version 1.24.0190 (Slican NC

  nvd.nist.gov

References

• Third Party Advisory · cert.pl
• Product · slican.pl