Sd 330Ac CVE-2026-32963

Q: What is the CVSS score of CVE-2026-32963?

CVE-2026-32963 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23756 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-20 jpcert

GHSA-v94v-gwmf-jhq8

XSS Sd 330Ac Amc Manager

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 20, 2026 - 04:22 NVD

6.1 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

Apr 20, 2026 - 04:09 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 04:00 euvd

EUVD-2026-23756

Analysis Generated

Apr 20, 2026 - 04:00 vuln.today

CVE Published

Apr 20, 2026 - 03:18 nvd

MEDIUM 5.1

DescriptionCVE.org

SD-330AC and AMC Manager provided by silex technology, Inc. contain a reflected cross-site scripting vulnerability. When a user logs in to the affected device and access some crafted web page, arbitrary script may be executed on the user's browser.

AnalysisAI

Reflected cross-site scripting (XSS) in Silex Technology SD-330AC and AMC Manager allows remote attackers to execute arbitrary JavaScript in users' browsers when they visit crafted web pages after authenticating to the affected device. The vulnerability requires user interaction and affects both products across all versions. No patch release or active exploitation status has been confirmed.

Technical ContextAI

This is a classic reflected XSS vulnerability (CWE-79) in web-based management interfaces. The affected products-Silex SD-330AC (a network device) and AMC Manager (asset management software)-fail to properly sanitize or encode user-supplied input in HTTP request parameters before reflecting them back in HTML responses. Because these are authenticated management interfaces, the attack surface is confined to users already logged into the device or software. The vulnerability manifests when an attacker crafts a malicious URL containing JavaScript payload and tricks an authenticated user into clicking it, causing the payload to execute in the context of the victim's browser session. This can lead to session hijacking, credential theft, or unauthorized actions on behalf of the authenticated user.

RemediationAI

Check Silex Technology's official security advisories at https://www.silex.jp/support/security-advisories/en/2026-001 for patch availability and fixed versions-this information is not confirmed in the provided intelligence. If a patched version is available, upgrade SD-330AC and AMC Manager immediately. Until patched versions are deployed, implement the following compensating controls: (1) Restrict administrative access to SD-330AC and AMC Manager to trusted IP addresses or VPN endpoints, reducing exposure to external attackers crafting malicious links; (2) educate administrators not to click on links or open emails from untrusted sources that reference the management interface; (3) deploy a web application firewall (WAF) configured to detect and block reflected XSS payloads in HTTP requests to these services (trade-off: may cause false positives affecting legitimate administration); (4) disable or restrict the affected web management interface if command-line or out-of-band management is available as an alternative. Contact Silex support directly for patch status and timeline.