Skip to main content

Sd 330Ac CVE-2026-32964

| EUVDEUVD-2026-23757 MEDIUM
Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
2026-04-20 jpcert GHSA-5f3w-cmwx-c9m9
Code Injection Sd 330Ac Amc Manager
6.9
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
CVSS changed
Apr 20, 2026 - 04:22 NVD
6.5 (MEDIUM) 6.9 (MEDIUM)
Analysis Generated
Apr 20, 2026 - 04:09 vuln.today
EUVD ID Assigned
Apr 20, 2026 - 04:00 euvd
EUVD-2026-23757
Analysis Generated
Apr 20, 2026 - 04:00 vuln.today
CVE Published
Apr 20, 2026 - 03:17 nvd
MEDIUM 6.9

DescriptionCVE.org

SD-330AC and AMC Manager provided by silex technology, Inc. contain an improper neutralization of CRLF sequences ('CRLF Injection') vulnerability. Processing some crafted configuration data may lead to arbitrary entries injected to the system configuration.

AnalysisAI

CRLF injection in Silex Technology SD-330AC and AMC Manager allows unauthenticated remote attackers to inject arbitrary configuration entries via crafted input, degrading system integrity and availability. The vulnerability affects all versions of both products and requires no authentication or user interaction, with public disclosure through JPCERT and vendor advisories indicating elevated awareness in production environments.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send HTTP request to configuration endpoint
Delivery
Embed CRLF sequences in config parameter
Exploit
Trigger config file write
Execution
Inject arbitrary configuration directives
Persist
Corrupt system settings
Impact
Degrade device integrity or availability
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The vulnerability requires network-accessible SD-330AC or AMC Manager with default or exposed configuration endpoints. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This vulnerability presents significant real-world risk despite a moderate CVSS score of 6.5. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker on the network sends a crafted HTTP or API request to the SD-330AC or AMC Manager configuration endpoint, embedding CRLF sequences in a parameter field (e.g., a device name, DNS setting, or access control list entry). The application parses the input without sanitization and writes it directly to the system configuration file. …
Remediation Check the Silex Technology security advisories (https://www.silex.jp/support/security-advisories/en/2026-001) for patched versions specific to your SD-330AC and AMC Manager installations, as exact fix versions are not provided in available data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Sd 330Ac

View all
CVE-2026-32956 CRITICAL
9.3 Apr 20

Remote code execution in silex technology SD-330AC and AMC Manager allows unauthenticated network attackers to execute a
CVE-2026-32955 HIGH
8.7 Apr 20

Stack-based buffer overflow in silex technology's SD-330AC (Ver.1.42 and earlier) and AMC Manager (Ver.5.0.2 and earlier
CVE-2026-32965 HIGH
8.7 Apr 20

SD-330AC wireless LAN modules and AMC Manager devices from silex technology allow unauthenticated remote attackers to mo
CVE-2026-32959 HIGH
8.2 Apr 20

Weak cryptographic implementation in Silex Technology SD-330AC wireless LAN adapters (v1.42 and earlier) and AMC Manager
CVE-2026-32960 HIGH
7.1 Apr 20

Authentication bypass in silex technology SD-330AC (≤1.42) and AMC Manager (≤5.0.2) allows remote attackers to gain unau
CVE-2026-32957 MEDIUM
6.9 Apr 20

Unauthenticated arbitrary file upload in Silex Technology SD-330AC and AMC Manager firmware maintenance functions allows
CVE-2026-32962 MEDIUM
6.9 Apr 20

SD-330AC and AMC Manager by Silex Technology lack authentication controls on critical configuration functions, allowing

CVE-2026-32961 MEDIUM
6.9 Apr 20

Heap-based buffer overflow in Silex SD-330AC and AMC Manager packet processing allows remote unauthenticated attackers t
CVE-2026-32958 MEDIUM
6.9 Apr 20

Hard-coded cryptographic keys in Silex Technology SD-330AC and AMC Manager enable attackers to forge firmware updates th
CVE-2026-32963 MEDIUM
5.1 Apr 20

Reflected cross-site scripting (XSS) in Silex Technology SD-330AC and AMC Manager allows remote attackers to execute arb

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

View all
CVE-2026-23953 HIGH POC
8.7
CVE-2026-21428 HIGH POC
7.5
CVE-2025-25184 MEDIUM POC
5.7
CVE-2026-45372 CRITICAL
9.9
CVE-2026-1536 MEDIUM POC
5.8
CVE-2026-1467 MEDIUM POC
5.8
CVE-2026-11362 CRITICAL
9.8
CVE-2026-30227 MEDIUM POC
5.3

Same technique Code Injection

View all
CVE-2012-0158 HIGH POC
8.8
CVE-2025-24893 CRITICAL POC
9.8
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-3906 HIGH POC
7.8
CVE-2017-8759 HIGH POC
7.8
CVE-2025-49704 HIGH POC
8.8
CVE-2026-1281 CRITICAL POC
9.8
CVE-2026-1340 CRITICAL POC
9.8

Share

CVE-2026-32964 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy