Which versions of Sd 330Ac are affected by CVE-2026-32956?

Silex Technology SD-330AC wireless bridge and AMC Manager software contain a critical remote code execution vulnerability (CVE-2026-32956, CVSS 9.3) that allows unauthenticated attackers to execute…

How to fix or mitigate CVE-2026-32956?

Within 24 hours: Identify all SD-330AC devices and AMC Manager installations in your environment using network discovery tools; document their network exposure (internet-facing vs. internal-only) and criticality. Within 7 days: Implement network segmentation to restrict access to affected devices to trusted networks only; disable remote management features if not essential; enable detailed logging and alerting on these systems. Within 30 days: Monitor Silex Technology security advisories daily for patch release; establish a patch testing environment; prepare deployment procedures for immediate application once vendor-released patches are available.

Sd 330Ac CVE-2026-32956

Q: What is the CVSS score of CVE-2026-32956?

CVE-2026-32956 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23749 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-04-20 jpcert

GHSA-jwm2-xvrj-2mh2

Heap Overflow Buffer Overflow RCE Sd 330Ac Amc Manager

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 20, 2026 - 04:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 20, 2026 - 04:22 vuln.today

cvss_changed

CVSS changed

Apr 20, 2026 - 04:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Apr 20, 2026 - 04:09 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 04:00 euvd

EUVD-2026-23749

Analysis Generated

Apr 20, 2026 - 04:00 vuln.today

CVE Published

Apr 20, 2026 - 03:20 nvd

CRITICAL 9.3

DescriptionCVE.org

SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in processing the redirect URLs. Arbitrary code may be executed on the device.

AnalysisAI

Remote code execution in silex technology SD-330AC and AMC Manager allows unauthenticated network attackers to execute arbitrary code via heap-based buffer overflow when processing redirect URLs. CVSS 9.3 critical severity with attack vector AV:N/AC:L/PR:N/UI:N indicates trivial exploitation against internet-facing devices. No public exploit identified at time of analysis, though JPCERT coordination suggests vendor-confirmed vulnerability. EPSS data not available; real-world risk depends on internet exposure of affected silex wireless bridge and management software installations.

Technical ContextAI

This vulnerability affects silex technology's SD-330AC (a wireless bridge/access point device) and AMC Manager (device management software). The flaw is a heap-based buffer overflow (CWE-122) triggered during redirect URL processing, likely in HTTP/HTTPS handling code that parses Location headers or similar redirect mechanisms. Heap overflows occur when data copied to dynamically allocated memory exceeds buffer boundaries, corrupting adjacent heap structures. Unlike stack overflows, heap exploitation can overwrite function pointers, virtual tables, or heap metadata to achieve code execution. The redirect URL attack vector suggests the vulnerability lies in web server components or administrative interfaces that handle URL redirection, making it exploitable through crafted HTTP requests without prior authentication.

RemediationAI

Apply vendor-released patches detailed in silex technology security advisory 2026-001 available at https://www.silex.jp/support/security-advisories/en/2026-001. Exact patched firmware versions for SD-330AC and AMC Manager software releases are specified in the advisory; prioritize upgrading internet-facing installations immediately. If patching cannot be completed within 24-48 hours, implement these compensating controls: (1) Remove SD-330AC devices and AMC Manager interfaces from public internet exposure by placing behind firewall with strict IP whitelisting for administrative access only - eliminates AV:N attack vector but requires VPN for remote management. (2) Disable HTTP/HTTPS redirect functionality in device configuration if operationally feasible - may break legitimate redirect-based workflows but prevents exploitation of the specific vulnerable code path. (3) Deploy intrusion prevention signatures to detect malformed redirect URL patterns in HTTP requests targeting silex devices - effective against automated exploitation but bypassable with obfuscation. Note that compensating controls do not eliminate the vulnerability and should be temporary measures only.