PHP Function Injection in Slican NPC/IPL/IPM/IPU

Successful exploitation of CVE-2025-14577 allows an attacker to execute arbitrary PHP code on the affected Slican device. This grants them complete control over the system, enabling actions such as data theft, modification of system configurations, installation of malware, and potentially pivoting to other systems on the network. The lack of authentication required for exploitation significantly broadens the attack surface, making the vulnerability particularly concerning. Given the potential for remote code execution, the blast radius extends to any data or services hosted on the compromised device, and the attacker could leverage the device as a launchpad for further attacks within the network.

Organizations utilizing Slican NCP/IPL/IPM/IPU devices in industrial control systems or network infrastructure are particularly at risk. Legacy deployments with outdated firmware versions are especially vulnerable. Shared hosting environments where multiple users share the same Slican device could also be impacted, as an attacker could potentially exploit the vulnerability to gain access to other users' data or systems.

• linux / server: Monitor access logs for requests to /webcti/session_ajax.php containing unusual or suspicious parameters. Use journalctl to filter for PHP errors related to function injection.

journalctl -u php-fpm -g 'session_ajax.php'

• generic web: Use curl to test the /webcti/sessionajax.php endpoint with a simple PHP command as a parameter (e.g., curl 'http://<target>/webcti/sessionajax.php?cmd=phpinfo()' ). A successful response indicating PHP execution confirms the vulnerability.

curl 'http://<target>/webcti/session_ajax.php?cmd=phpinfo()'

1. 2026-02-24Disclosure

   disclosure

1. Reserviert2025-12-12
2. Veröffentlicht2026-02-24
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-14577 is to upgrade the affected Slican NCP/IPL/IPM/IPU devices to version 1.24.0190 (NCP) or 6.61.0010 (IPL/IPM/IPU). If immediate upgrading is not possible, consider implementing temporary workarounds such as restricting access to the /webcti/sessionajax.php endpoint using a web application firewall (WAF) or proxy server. Configure the WAF to block any requests containing suspicious PHP code or unexpected parameters. Additionally, monitor system logs for unusual PHP execution patterns or attempts to access the vulnerable endpoint. After upgrading, confirm the fix by attempting to access the /webcti/sessionajax.php endpoint with a crafted payload; successful access indicates the vulnerability remains.