Amc Manager CVE-2026-32955

Exploitation requires valid authentication credentials with low-privilege access (PR:L) to the web-based management interface of SD-330AC or AMC Manager. The vulnerability is exploitable against default configurations once an attacker obtains legitimate user credentials through phishing, credential stuffing, or insider access. No special product configuration, non-default features, or specific deployment modes are required beyond normal operational state with the management interface accessible. Attack complexity is low (AC:L) with no user interaction needed (UI:N) once authenticated. Exploitation is LIMITED by the authentication barrier-attackers must first compromise valid credentials or have insider access-and by network accessibility to the management interface, which in properly segmented deployments should be restricted to administrative networks only. The low EPSS score suggests real-world exploitation is further constrained by the specialized nature of these industrial wireless LAN products and their relatively narrow deployment base compared to mass-market network devices.

Real-world risk assessment reveals divergent signals requiring careful interpretation. CVSS 4.0 score of 8.7 reflects high severity with network attack vector (AV:N), low complexity (AC:L), and complete system impact (VC:H/VI:H/VA:H), but crucially requires low-level authentication (PR:L) with no scope change (SC:N/SI:N/SA:N). This authentication requirement significantly constrains the attack surface compared to unauthenticated network exploits. EPSS probability of 0.04% (12th percentile) corroborates this-despite enabling RCE, the vulnerability shows minimal exploitation activity in the wild, likely due to the authentication prerequisite and the specialized nature of the affected industrial/enterprise networking products. SSVC framework marks exploitation status as 'none' and automatable as 'no', suggesting manual exploitation requiring product-specific knowledge. Technical impact rating of 'total' aligns with arbitrary code execution capability. The authentication barrier and narrow product deployment base (specialized wireless LAN infrastructure) reduce probability of mass exploitation, though targeted attacks against organizations using these specific silex products remain viable. This is a genuine high-impact vulnerability requiring remediation, but the authentication requirement and low EPSS score indicate it's not experiencing active widespread exploitation-making it lower priority than similarly-scored unauthenticated RCE flaws.

An attacker with valid low-privilege credentials to the SD-330AC or AMC Manager web interface authenticates to the administrative portal and crafts an HTTP request containing an oversized redirect URL parameter exceeding stack buffer capacity. The malicious request triggers the buffer overflow during URL processing, overwriting the stack return address to point to attacker-supplied shellcode embedded in the overflow data. Upon function return, execution transfers to the injected code, granting the attacker arbitrary code execution with the privileges of the web service process, potentially enabling full device compromise, network reconnaissance, or pivot attacks against connected infrastructure.