Amc Manager CVE-2026-32961

The sx_smpd service must be network-accessible and listening on its management port. No special authentication is required (CVSS PR:N confirms unauthenticated access). The vulnerability is triggered by receipt of a single crafted packet, requiring no user interaction or specific device configuration-default SD-330AC and AMC Manager deployments with sx_smpd running are vulnerable. Attack is limited to remote network hosts with Layer 3 connectivity to the management port; local exploitation is not applicable. Non-vulnerable systems would be those with sx_smpd disabled or network-isolated from potential attackers.

CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates moderate real-world risk: network-accessible, low attack complexity, no authentication required, but impact limited to availability (temporary DoS). EPSS score not provided in input data. The vulnerability does not permit remote code execution or data exfiltration, only denial-of-service. However, the combination of network accessibility, lack of authentication barriers, and low attack complexity means any network-connected instance is vulnerable to DoS attacks. No CISA KEV status provided; vulnerability is reported by JPCERT (Japanese vendor coordination center), suggesting disclosure through coordinated responsible disclosure rather than active in-the-wild exploitation at time of report. Heap overflows can sometimes be exploited for code execution with sufficient heap control; however, this CVE explicitly limits impact to DoS, suggesting either the overflow is difficult to convert to RCE or vendor testing confirmed DoS-only impact. Priority is moderate: defenders should patch, but this is not an emergency code execution vulnerability.

An attacker on the network crafts a malicious packet conforming to the sx_smpd protocol and sends it to the SD-330AC or AMC Manager management interface without authentication. The packet triggers the heap buffer overflow in packet data processing, corrupting heap memory and causing the sx_smpd process to crash. The device becomes unavailable until the service is manually restarted or automatically restarts, resulting in temporary denial of service to legitimate management operations.