Amc Manager CVE-2026-32960

Requires network access to SD-330AC management interface or AMC Manager web console. User interaction is required (CVSS 4.0 UI:P), indicating successful exploitation depends on timing coordination with legitimate administrator activity or specific user-triggered conditions that cause memory reuse patterns. No authentication credentials needed (PR:N), but the UI:P constraint suggests attackers must either predict when administrators will access the system to create vulnerable memory states, or social engineer users to trigger the condition. Exploitation is limited to installations where administrative interfaces are network-accessible to potential attackers - devices on isolated management VLANs or with IP-restricted access controls significantly reduce exploitability. Attack does not work against offline devices or those without active user sessions creating the memory residue condition.

Real-world risk is moderate despite the 7.1 CVSS score. SSVC assessment shows no active exploitation, non-automatable attack requiring user interaction, and partial technical impact (integrity compromise without confidentiality or availability effects). CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) confirms network accessibility but highlights the UI:P requirement as a limiting factor - attackers cannot exploit this remotely without user presence or action on the device. EPSS score of 0.03% (7th percentile) aligns with SSVC findings, indicating security researchers and threat actors have not prioritized this vulnerability. The high integrity impact (VI:H) reflects authentication bypass severity, but scope is unchanged (SC:N/SI:N/SA:N), meaning compromise is contained to the vulnerable component. This is NOT a critical exposure for most organizations - prioritize for internet-facing SD-330AC devices and AMC Manager instances in environments where attackers have network proximity and can coordinate with user activity. Lower priority for air-gapped networks or installations with compensating network access controls. Data is consistent across sources with no conflicting signals, though exact attack mechanics are not detailed in public advisories.

Attacker on the same network as SD-330AC device monitors legitimate administrator login traffic to establish timing patterns. When admin initiates a session, attacker sends crafted authentication packet designed to reference residual session tokens or credential hashes left in memory from the prior allocation cycle. Due to insufficient memory sanitization (CWE-226), the device's authentication handler processes the stale data as valid credentials, granting unauthorized administrative access without requiring the actual password. Attacker modifies device configuration, intercepts wireless traffic, or pivots to connected networks. Attack requires network proximity and timing coordination with legitimate user activity (explaining UI:P constraint), but public exploit code has not been identified at time of analysis.