Skip to main content

Sd 330Ac CVE-2026-32955

| EUVDEUVD-2026-23747 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-04-20 jpcert GHSA-c6qj-q5j5-mvcc
8.7
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

7
Analysis Updated
Apr 20, 2026 - 04:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Apr 20, 2026 - 04:22 vuln.today
cvss_changed
CVSS changed
Apr 20, 2026 - 04:22 NVD
8.8 (HIGH) 8.7 (HIGH)
Analysis Generated
Apr 20, 2026 - 04:09 vuln.today
EUVD ID Assigned
Apr 20, 2026 - 04:00 euvd
EUVD-2026-23747
Analysis Generated
Apr 20, 2026 - 04:00 vuln.today
CVE Published
Apr 20, 2026 - 03:19 nvd
HIGH 8.7

DescriptionCVE.org

SD-330AC and AMC Manager provided by silex technology, Inc. contain a stack-based buffer overflow vulnerability in processing the redirect URLs. Arbitrary code may be executed on the device.

AnalysisAI

Stack-based buffer overflow in silex technology's SD-330AC (Ver.1.42 and earlier) and AMC Manager (Ver.5.0.2 and earlier) enables authenticated remote attackers to execute arbitrary code on the device via maliciously crafted redirect URLs. Reported by JPCERT with vendor advisories published, though EPSS score of 0.04% (12th percentile) indicates low observed exploitation probability. No active exploitation confirmed (not in CISA KEV), and SSVC assessment marks exploitation status as 'none' despite the critical nature of remote code execution capability.

Technical ContextAI

This vulnerability affects silex technology's SD-330AC wireless LAN access controller and AMC Manager software, which handle device management and network configuration. The flaw is a CWE-121 stack-based buffer overflow occurring during redirect URL processing. Unlike heap-based overflows, stack-based buffer overflows directly corrupt return addresses and function pointers stored on the program stack, making them particularly suitable for code execution exploits. When processing redirect URLs-typically used in web-based authentication flows or administrative redirects-the affected products fail to validate input length before copying data into fixed-size stack buffers. This allows an authenticated attacker to overflow the buffer, overwrite adjacent memory including the return address, and redirect program execution to attacker-controlled code. The CPE data confirms both products from silex_technology,_inc. are affected across all versions up to the specified thresholds.

RemediationAI

Apply vendor-issued security updates by upgrading SD-330AC firmware to versions later than Ver.1.42 and AMC Manager to versions later than Ver.5.0.2 as detailed in silex technology security advisory 2026-001 at https://www.silex.jp/support/security-advisories/en/2026-001. Specific patched version numbers should be obtained directly from the vendor advisory as the source data does not specify exact fix versions. If immediate patching is not feasible, implement compensating controls: restrict administrative interface access to trusted management networks only via firewall rules or VLANs (eliminates network attack vector but reduces operational flexibility for remote management), enforce strong authentication with multi-factor authentication for all administrative accounts (raises attacker effort though does not eliminate the vulnerability), and monitor authentication logs for suspicious login patterns or unusual redirect URL parameters (detection-focused, does not prevent exploitation). Network segmentation provides the strongest interim protection by preventing untrusted network access to the management interfaces, though this may conflict with legitimate remote administration requirements.

CVE-2026-32956 CRITICAL
9.3 Apr 20

Remote code execution in silex technology SD-330AC and AMC Manager allows unauthenticated network attackers to execute a

CVE-2026-32965 HIGH
8.7 Apr 20

SD-330AC wireless LAN modules and AMC Manager devices from silex technology allow unauthenticated remote attackers to mo

CVE-2026-32959 HIGH
8.2 Apr 20

Weak cryptographic implementation in Silex Technology SD-330AC wireless LAN adapters (v1.42 and earlier) and AMC Manager

CVE-2026-32960 HIGH
7.1 Apr 20

Authentication bypass in silex technology SD-330AC (≤1.42) and AMC Manager (≤5.0.2) allows remote attackers to gain unau

CVE-2026-32957 MEDIUM
6.9 Apr 20

Unauthenticated arbitrary file upload in Silex Technology SD-330AC and AMC Manager firmware maintenance functions allows

CVE-2026-32962 MEDIUM
6.9 Apr 20

SD-330AC and AMC Manager by Silex Technology lack authentication controls on critical configuration functions, allowing

CVE-2026-32964 MEDIUM
6.9 Apr 20

CRLF injection in Silex Technology SD-330AC and AMC Manager allows unauthenticated remote attackers to inject arbitrary

CVE-2026-32961 MEDIUM
6.9 Apr 20

Heap-based buffer overflow in Silex SD-330AC and AMC Manager packet processing allows remote unauthenticated attackers t

CVE-2026-32958 MEDIUM
6.9 Apr 20

Hard-coded cryptographic keys in Silex Technology SD-330AC and AMC Manager enable attackers to forge firmware updates th

CVE-2026-32963 MEDIUM
5.1 Apr 20

Reflected cross-site scripting (XSS) in Silex Technology SD-330AC and AMC Manager allows remote attackers to execute arb

Share

CVE-2026-32955 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy