Sd 330Ac CVE-2026-32957

Q: What is the CVSS score of CVE-2026-32957?

CVE-2026-32957 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23750 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-04-20 jpcert

GHSA-332v-r8r4-hgh6

Authentication Bypass Sd 330Ac Amc Manager

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 20, 2026 - 04:22 NVD

5.3 (MEDIUM) 6.9 (MEDIUM)

Analysis Generated

Apr 20, 2026 - 04:10 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 04:00 euvd

EUVD-2026-23750

Analysis Generated

Apr 20, 2026 - 04:00 vuln.today

CVE Published

Apr 20, 2026 - 03:19 nvd

MEDIUM 6.9

DescriptionCVE.org

SD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for critical function issue on firmware maintenance. Arbitrary file may be uploaded on the device without authentication.

AnalysisAI

Unauthenticated arbitrary file upload in Silex Technology SD-330AC and AMC Manager firmware maintenance functions allows remote attackers to upload malicious files without credentials, potentially leading to device compromise or unauthorized firmware modification. The CVSS score of 5.3 reflects limited integrity impact in a network-accessible service with no authentication requirement, though the real-world risk depends on what actions an attacker can perform post-upload.

Technical ContextAI

The vulnerability exists in the firmware maintenance interface of SD-330AC (a network device) and AMC Manager (device management software). Both products implement file upload functionality for firmware updates but fail to enforce authentication at the API or endpoint level before accepting uploads, violating the principle of authentication-gated critical operations. This is a classic CWE-306 (Missing Authentication for Critical Function) issue where the firmware maintenance service accepts HTTP/network requests without validating user identity. The affected versions span all listed CPE strings (cpe:2.3:a:silex_technology,_inc.:sd-330ac:*:*:*:*:*:*:*:* and cpe:2.3:a:silex_technology,_inc.:amc_manager:*:*:*:*:*:*:*:*), indicating the flaw exists across product lineups, though specific version boundaries are not detailed in available advisories.

RemediationAI

Consult the Silex Technology security advisories at https://www.silex.jp/support/security-advisories/en/2026-001 and https://www.silex.jp/support/security-advisories/2026-001 for patched firmware versions and upgrade procedures specific to SD-330AC and AMC Manager. Until patched versions are confirmed and deployed, implement network-level access controls by restricting access to the firmware maintenance interface to authenticated administrative networks only (e.g., allow only internal IT subnets or VPN-authenticated clients to reach the maintenance endpoint). Disable or isolate the firmware maintenance service if it is not actively in use. Monitor network traffic for suspicious POST/PUT requests to the maintenance endpoint, particularly from external or untrusted sources. These compensating controls reduce exposure but do not eliminate the underlying authentication flaw; patching remains essential. Note that restricting network access may impede legitimate remote firmware updates if the organization relies on that capability.