Volerion logoVolerion
Volerion logoVolerion

Slican NCP/IPL/IPM/IPU PHP Function Injection Vulnerability Allowing Arbitrary Command Execution

Vulnerability

A PHP function injection vulnerability has been identified in Slican NCP, IPL, IPM, and IPU devices. This issue allows unauthenticated remote attackers to execute arbitrary PHP commands by sending specially crafted requests to the /webcti/session_ajax.php endpoint. The vulnerability affects all versions prior to 1.24.0190 for Slican NCP and all versions prior to 6.61.0010 for Slican IPL, IPM, and IPU.

Impact

Exploitation of this vulnerability allows for arbitrary PHP code execution on the affected device.

Remediation

Users can upgrade to Slican NCP version 1.24.0190 or Slican IPL/IPM/IPU version 6.61.0010 to address this vulnerability.

Added: Feb 24, 2026, 3:04 PM
Updated: Feb 24, 2026, 11:05 PM

Vulnerability Rating

Custom Algorithm
spread
0.0
impact
7.5
exploitability
7.4
remediation
0.0
relevance
3.1
threat
0.0
urgency
2.9
incentive
4.2

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.