Amc Manager CVE-2026-32964

The vulnerability requires network-accessible SD-330AC or AMC Manager with default or exposed configuration endpoints. CRLF injection succeeds when the device processes configuration data in text-based formats (such as INI, conf, or text-delimited files) without filtering CR and LF characters. Exploitation is not limited by platform type, specific firmware version, or non-default configuration-the wildcard version specification in CPE indicates all released versions are affected. The attack does not require user interaction (UI:N) or authentication (PR:N), meaning attackers do not need valid credentials or victim involvement. Limiting factors: devices isolated behind firewalls or network segmentation blocking unauthorized configuration requests are protected from remote exploitation. Local administrative access to the device file system can directly modify configuration, but this is a separate attack path. The vulnerability is specific to configuration processing; other functionality (if isolated from configuration injection) may not be impacted.

This vulnerability presents significant real-world risk despite a moderate CVSS score of 6.5. The network attack vector (AV:N), low complexity (AC:L), and lack of authentication requirement (PR:N/UI:N) indicate broad exploitability against default configurations. The integrity impact (I:L) and availability impact (A:L) reflect the practical consequence: injected configuration entries can disable features, redirect traffic, or degrade service. The CVSS score omits confidentiality impact (C:N), suggesting information disclosure is not a direct concern, but configuration tampering can indirectly expose sensitive data through misconfigured access controls. The JPCERT disclosure and vendor advisories confirm active awareness in the security community; however, EPSS exploitation probability and KEV (CISA Known Exploited Vulnerabilities) status are not provided in the input data. The scope is unchanged (S:U), limiting cross-boundary impact, but the attack requires no interaction and succeeds over unauthenticated network access, making this a high-priority issue for organizations deploying Silex storage infrastructure in accessible network segments.

An attacker on the network sends a crafted HTTP or API request to the SD-330AC or AMC Manager configuration endpoint, embedding CRLF sequences in a parameter field (e.g., a device name, DNS setting, or access control list entry). The application parses the input without sanitization and writes it directly to the system configuration file. The injected line breaks cause the parser to interpret subsequent attacker-controlled text as new configuration directives, such as disabling authentication, modifying network routes, or changing access permissions. The attacker gains control over device behavior without authentication or user interaction.