Sd 330Ac CVE-2026-32964

Q: What is the CVSS score of CVE-2026-32964?

CVE-2026-32964 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23757 MEDIUM

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-04-20 jpcert

GHSA-5f3w-cmwx-c9m9

Code Injection Sd 330Ac Amc Manager

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 20, 2026 - 04:22 NVD

6.5 (MEDIUM) 6.9 (MEDIUM)

Analysis Generated

Apr 20, 2026 - 04:09 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 04:00 euvd

EUVD-2026-23757

Analysis Generated

Apr 20, 2026 - 04:00 vuln.today

CVE Published

Apr 20, 2026 - 03:17 nvd

MEDIUM 6.9

DescriptionCVE.org

SD-330AC and AMC Manager provided by silex technology, Inc. contain an improper neutralization of CRLF sequences ('CRLF Injection') vulnerability. Processing some crafted configuration data may lead to arbitrary entries injected to the system configuration.

AnalysisAI

CRLF injection in Silex Technology SD-330AC and AMC Manager allows unauthenticated remote attackers to inject arbitrary configuration entries via crafted input, degrading system integrity and availability. The vulnerability affects all versions of both products and requires no authentication or user interaction, with public disclosure through JPCERT and vendor advisories indicating elevated awareness in production environments.

Technical ContextAI

CRLF (Carriage Return/Line Feed) injection exploits improper neutralization of sequence characters (CWE-93) in configuration processing pipelines. When user-supplied input is embedded directly into configuration files or system settings without sanitization, attackers can inject CR (\r) and LF (\n) characters to break line boundaries and insert malicious configuration directives. The SD-330AC is a network storage device and AMC Manager is its administrative interface; both parse configuration data in text-based formats vulnerable to line-boundary manipulation. The attack leverages the network-accessible configuration endpoints of these devices to corrupt system state without requiring prior authentication.

RemediationAI

Check the Silex Technology security advisories (https://www.silex.jp/support/security-advisories/en/2026-001) for patched versions specific to your SD-330AC and AMC Manager installations, as exact fix versions are not provided in available data. Apply vendor-released patches or firmware updates immediately upon availability. Immediate compensating controls include: restrict network access to SD-330AC and AMC Manager administrative interfaces using network segmentation or firewall rules-only permit configuration access from trusted management subnets, disabling internet-facing exposure of these services. Disable remote configuration APIs if not required for operational workflows, reducing the attack surface. Implement input validation or Web Application Firewall (WAF) rules to block requests containing CRLF sequences (%0D%0A, carriage return, line feed characters) in configuration parameters, though this may block legitimate but unusual configuration patterns. Monitor system configuration files for unauthorized modifications using file integrity monitoring (FIM) tools, alerting on unexpected changes to device settings. These controls mitigate the immediate risk while patch availability is confirmed.