Skip to main content

Sd 330Ac CVE-2026-32958

| EUVDEUVD-2026-23751 MEDIUM
Use of Hard-coded Cryptographic Key (CWE-321)
2026-04-20 jpcert GHSA-w7w2-59m3-j62x
Information Disclosure Sd 330Ac Amc Manager
6.9
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

5
CVSS changed
Apr 20, 2026 - 04:22 NVD
6.5 (MEDIUM) 6.9 (MEDIUM)
Analysis Generated
Apr 20, 2026 - 04:10 vuln.today
EUVD ID Assigned
Apr 20, 2026 - 04:00 euvd
EUVD-2026-23751
Analysis Generated
Apr 20, 2026 - 04:00 vuln.today
CVE Published
Apr 20, 2026 - 03:19 nvd
MEDIUM 6.9

DescriptionCVE.org

SD-330AC and AMC Manager provided by silex technology, Inc. use a hard-coded cryptographic key. An administrative user may be directed to apply a fake firmware update.

AnalysisAI

Hard-coded cryptographic keys in Silex Technology SD-330AC and AMC Manager enable attackers to forge firmware updates that administrative users may be tricked into applying via social engineering, allowing arbitrary firmware installation without detection. The vulnerability affects all versions of both products and exploits a fundamental key management flaw (CWE-321). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reverse-engineer firmware to extract hard-coded key
Delivery
Craft malicious firmware image and sign it
Exploit
Deliver phishing email impersonating Silex support
Execution
Social engineer admin to click update link
Persist
Administrator applies fake firmware via AMC Manager
Impact
Malicious code executes on SD-330AC hardware
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Hard-coded cryptographic key must be obtained or derived by the attacker - this typically requires firmware reverse-engineering, leaked documentation, or public disclosure of the key material. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS and real-world signals present a moderate-to-significant risk profile with important nuance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker reverse-engineers the SD-330AC firmware or obtains the hard-coded cryptographic key through public research or supply-chain exposure, then crafts a malicious firmware image signed with the legitimate key. The attacker sends a phishing email to a network administrator managing SD-330AC devices, impersonating Silex support with a fake 'critical security update' link or attachment. …
Remediation Silex Technology has not provided explicit patch version information in available references - verify directly with vendor at https://www.silex.jp/support/security-advisories/en/2026-001 for the specific patched version and availability timeline. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Sd 330Ac

View all
CVE-2026-32956 CRITICAL
9.3 Apr 20

Remote code execution in silex technology SD-330AC and AMC Manager allows unauthenticated network attackers to execute a
CVE-2026-32955 HIGH
8.7 Apr 20

Stack-based buffer overflow in silex technology's SD-330AC (Ver.1.42 and earlier) and AMC Manager (Ver.5.0.2 and earlier
CVE-2026-32965 HIGH
8.7 Apr 20

SD-330AC wireless LAN modules and AMC Manager devices from silex technology allow unauthenticated remote attackers to mo
CVE-2026-32959 HIGH
8.2 Apr 20

Weak cryptographic implementation in Silex Technology SD-330AC wireless LAN adapters (v1.42 and earlier) and AMC Manager
CVE-2026-32960 HIGH
7.1 Apr 20

Authentication bypass in silex technology SD-330AC (≤1.42) and AMC Manager (≤5.0.2) allows remote attackers to gain unau
CVE-2026-32957 MEDIUM
6.9 Apr 20

Unauthenticated arbitrary file upload in Silex Technology SD-330AC and AMC Manager firmware maintenance functions allows
CVE-2026-32962 MEDIUM
6.9 Apr 20

SD-330AC and AMC Manager by Silex Technology lack authentication controls on critical configuration functions, allowing

CVE-2026-32964 MEDIUM
6.9 Apr 20

CRLF injection in Silex Technology SD-330AC and AMC Manager allows unauthenticated remote attackers to inject arbitrary

CVE-2026-32961 MEDIUM
6.9 Apr 20

Heap-based buffer overflow in Silex SD-330AC and AMC Manager packet processing allows remote unauthenticated attackers t
CVE-2026-32963 MEDIUM
5.1 Apr 20

Reflected cross-site scripting (XSS) in Silex Technology SD-330AC and AMC Manager allows remote attackers to execute arb

Same weakness CWE-321 – Use of Hard-coded Cryptographic Key

View all
CVE-2025-30406 CRITICAL POC
9.0
CVE-2025-13316 HIGH POC
8.2
CVE-2025-57174 CRITICAL POC
9.8
CVE-2025-59407 CRITICAL POC
9.8
CVE-2024-58134 HIGH POC
8.1
CVE-2026-1442 HIGH POC
7.8
CVE-2026-28742 CRITICAL
9.2
CVE-2026-32644 CRITICAL
9.2

Same technique Information Disclosure

View all
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2014-6324 HIGH POC
8.8
CVE-2017-0213 HIGH POC
7.3
CVE-2016-7255 HIGH POC
7.8
CVE-2010-0232 HIGH POC
7.8
CVE-2025-30066 HIGH POC
8.6
CVE-2025-54236 CRITICAL POC
9.1

Share

CVE-2026-32958 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy