Threat Investigation
Request a demo

CVE-2025-14577

Critical

Description

Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/session_ajax.php endpoint. This issue was fixed in version 1.24.0190 (Slican NCP) and 6.61.0010 (Slican IPL/IPM/IPU).

SeverityCritical
CVSS9.8
Exploit probability—
ProductSlican Ncp Firmware
PublishedFeb 24, 2026
First seenFeb 24, 2026
Weakness typeCWE-306Missing authentication for critical function

How to fix

Update
  • slican ncp_firmware1.24.0190 or later
  • slican ipl-256_firmware6.61.0010 or later
  • slican ipm-032_firmware6.61.0010 or later
  • slican ipu-14_firmware6.61.0010 or later

Affected products

ProductAffected versionsFixed in
slican ncp_firmwarev < 1.24.01901.24.0190
slican ipl-256_firmwarev < 6.61.00106.61.0010
slican ipm-032_firmwarev < 6.61.00106.61.0010
slican ipu-14_firmwarev < 6.61.00106.61.0010

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.