Which versions of Sd 330Ac are affected by CVE-2026-32965?

Silex SD-330AC wireless LAN adapters and AMC Manager devices ship with null default credentials, allowing unauthenticated remote attackers to modify device settings and configurations over the…

How to fix or mitigate CVE-2026-32965?

Within 24 hours: Identify and inventory all Silex SD-330AC adapters and AMC Manager instances in your environment using network scanning or asset management systems. Within 7 days: Isolate affected devices to a segregated management VLAN with strict access controls and disable remote management interfaces where operationally feasible. Within 30 days: Contact Silex for patched firmware versions, apply any available security updates immediately upon release, and implement mandatory credential changes with strong passwords on all instances that remain in production.

Sd 330Ac CVE-2026-32965

Q: What is the CVSS score of CVE-2026-32965?

CVE-2026-32965 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23758 HIGH

Initialization of a Resource with an Insecure Default (CWE-1188)

2026-04-20 jpcert

GHSA-5842-r2vf-gmxv

Information Disclosure Sd 330Ac Amc Manager

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 20, 2026 - 04:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 20, 2026 - 04:22 vuln.today

cvss_changed

CVSS changed

Apr 20, 2026 - 04:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Apr 20, 2026 - 04:09 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 04:00 euvd

EUVD-2026-23758

Analysis Generated

Apr 20, 2026 - 04:00 vuln.today

CVE Published

Apr 20, 2026 - 03:17 nvd

HIGH 8.7

DescriptionCVE.org

Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex technology, Inc. When the affected device is connected to the network with the initial (factory-default) configuration, the device can be configured with the null string password.

AnalysisAI

SD-330AC wireless LAN modules and AMC Manager devices from silex technology allow unauthenticated remote attackers to modify device configuration using null-string passwords when devices remain in factory-default state. CVSS:4.0 8.7 (High Vector, High Integrity Impact) rates this as high severity due to network-based attack vector with no authentication required (AV:N/PR:N/UI:N). EPSS probability remains low at 0.03% (8th percentile), suggesting limited observed exploitation attempts. No active exploitation confirmed at time of analysis per available intelligence. Vulnerability class CWE-1188 (insecure default initialization) represents common industrial IoT security gap where devices ship with unsafe out-of-box configurations.

Technical ContextAI

CWE-1188 (Initialization of a Resource with an Insecure Default) vulnerability in silex technology industrial wireless networking products. SD-330AC is a compact wireless LAN device module commonly deployed in industrial automation and embedded systems. AMC Manager provides centralized management for silex wireless infrastructure. The flaw stems from factory-default configuration allowing authentication with null (empty) password strings when devices first connect to networks. CVSS:4.0 vector indicates network-based attack (AV:N), low complexity (AC:L), no attack prerequisites (AT:N), no privileges required (PR:N), and no user interaction (UI:N), with high integrity impact (VI:H) but no confidentiality or availability impact. This configuration vulnerability enables unauthorized administrative access to device settings before initial hardening, a common supply chain security issue in embedded networking equipment.

RemediationAI

Immediately change default passwords on all SD-330AC and AMC Manager devices to strong unique credentials following vendor hardening guidelines in security advisory https://www.silex.jp/support/security-advisories/en/2026-001. For new deployments, configure authentication credentials before connecting devices to production networks - perform initial configuration on isolated management network segment. Organizations should audit existing silex technology device inventories to identify units still using factory defaults, prioritizing internet-facing or inter-VLAN accessible devices. If immediate credential rotation is not feasible, implement compensating controls: restrict network access to affected devices using firewall rules permitting only specific administrator source IPs, deploy network segmentation isolating industrial wireless infrastructure from general corporate networks (accept performance impact of additional routing hops), and enable logging to detect unauthorized configuration attempts (generates high log volume during deployment phases). Vendor advisory does not specify patched firmware versions eliminating insecure defaults - remediation relies on manual configuration hardening rather than software update.