Which versions of Sd 330Ac are affected by CVE-2026-32959?

Silex Technology SD-330AC wireless devices and AMC Manager software are vulnerable to man-in-the-middle attacks due to weak cryptographic algorithms, enabling network-positioned attackers to…

How to fix or mitigate CVE-2026-32959?

Within 24 hours: Identify all SD-330AC devices and AMC Manager installations in your environment using network discovery tools; isolate affected devices to trusted, segmented networks only. Within 7 days: Contact Silex Technology for patch availability and timeline; document current deployment locations and data flows; implement network-level monitoring for suspicious traffic on ports associated with device management. Within 30 days: Evaluate vendor-supplied patches immediately upon release and plan staged deployment; consider temporary replacement with alternative wireless management solutions if patch timeline exceeds organizational risk tolerance; complete migration or patching of all affected systems.

Sd 330Ac CVE-2026-32959

Q: What is the CVSS score of CVE-2026-32959?

CVE-2026-32959 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23752 HIGH

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2026-04-20 jpcert

GHSA-gj69-pmwp-f535

Information Disclosure Sd 330Ac Amc Manager

8.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 20, 2026 - 04:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 20, 2026 - 04:22 vuln.today

cvss_changed

Severity Changed

Apr 20, 2026 - 04:22 NVD

MEDIUM HIGH

CVSS changed

Apr 20, 2026 - 04:22 NVD

5.9 (MEDIUM) 8.2 (HIGH)

Analysis Generated

Apr 20, 2026 - 04:10 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 04:00 euvd

EUVD-2026-23752

Analysis Generated

Apr 20, 2026 - 04:00 vuln.today

CVE Published

Apr 20, 2026 - 03:18 nvd

HIGH 8.2

DescriptionCVE.org

SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a broken or risky cryptographic algorithm. Information in the traffic may be retrieved via man-in-the-middle attack.

AnalysisAI

Weak cryptographic implementation in Silex Technology SD-330AC wireless LAN adapters (v1.42 and earlier) and AMC Manager software (v5.0.2 and earlier) allows network-positioned attackers to intercept and decrypt network traffic through man-in-the-middle attacks. The vulnerability stems from use of broken or risky cryptographic algorithms (CWE-327), enabling confidentiality breach of transmitted data. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability, and CISA SSVC framework classifies this as non-exploited with non-automatable attacks requiring attacker positioning. No public exploit code or active exploitation reported at time of analysis.

Technical ContextAI

This vulnerability affects Silex Technology's SD-330AC wireless LAN adapter and its management software AMC Manager, both enterprise products for managing wireless device connectivity. The root cause is CWE-327 (Use of a Broken or Risky Cryptographic Algorithm), indicating the products implement outdated, weak, or improperly configured encryption protocols for network communications. Common manifestations include use of deprecated SSL/TLS versions (SSLv3, TLS 1.0/1.1), weak cipher suites (DES, RC4, export-grade ciphers), insufficient key lengths, or broken implementations of otherwise-secure algorithms. The CVSS 4.0 vector shows network attack vector (AV:N) with low complexity (AC:L) but requires specific attack positioning (AT:P), consistent with man-in-the-middle scenarios where attackers must intercept network path between client and server. The vulnerability impacts only confidentiality (VC:H) without integrity or availability effects, meaning attackers can read but not modify traffic or disrupt service.

RemediationAI

Apply vendor-supplied patches by upgrading SD-330AC firmware to version 1.43 or later and AMC Manager software to version 5.0.3 or later (exact fix versions should be confirmed from Silex Technology security advisory at https://www.silex.jp/support/security-advisories/en/2026-001). Until patching is complete, implement network segmentation to isolate affected devices on trusted VLANs with strict access control lists preventing unauthorized network positioning between clients and devices. Deploy 802.1X port-based network access control and enable Dynamic ARP Inspection (DAI) plus DHCP snooping on managed switches to prevent ARP spoofing attacks that enable MITM positioning. For high-security environments, tunnel all traffic through VPN with verified strong cryptography (TLS 1.3 with AEAD cipher suites) to create encrypted overlay protecting weak device-level encryption until firmware updates can be applied. Note that network controls add operational complexity and may impact device discovery or management workflows - test thoroughly before production deployment. Implement monitoring for ARP anomalies and certificate validation failures as detection mechanisms for MITM attempts.