CVE-2025-14577 - CVE House
Back to Database
Status published Critical CVE-2025-14577

PHP Function Injection in Slican NPC/IPL/IPM/IPU

Vulnerability Description

Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/session_ajax.php endpoint. This issue was fixed in version 1.24.0190 (Slican NCP) and 6.61.0010 (Slican IPL/IPM/IPU).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-14577

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Dariusz Gońda

References

Affected Vendor

Affected Software

NCP, IPL, IPM, IPU
Vulnerable Versions:
0

Timeline

Official Publish: February 24th, 2026
Last Modified: February 24th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-306

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1136 Create Account
Persistence
T1098 Account Manipulation
Privilege Escalation
T1021 Remote Services
Lateral Movement