Amc Manager EUVD-2026-23750

The firmware maintenance endpoint must be network-accessible (no firewall blocking). No authentication token, certificate, or session is required - the endpoint accepts unauthenticated requests. The attacker must be able to send HTTP POST or PUT requests to the maintenance API. The vulnerability does not require any special configuration or non-default setup; it affects default deployments of SD-330AC and AMC Manager. Exploitation is limited only by whether downstream file validation (signature checks, checksum verification) prevents the uploaded file from being applied or executed; if such checks exist and are enabled, the attacker may still upload a file but cannot guarantee it will be processed.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates low attack complexity, network accessibility, and no user interaction required, but the integrity impact is rated as LOW rather than HIGH, suggesting the attack succeeds but may not directly execute code or cause immediate system failure. The lack of confidentiality or availability impact in the CVSS rating is notable - it indicates the uploaded file alone does not trigger remote code execution or denial of service in the scoring model, though in practice, uploading arbitrary firmware could lead to device takeover depending on validation downstream. No EPSS score, KEV status, or public exploit code is provided in the input data, making it impossible to confirm active real-world exploitation; the vulnerability may be known to defenders but not yet weaponized at scale. The authentication bypass nature (PR:N in CVSS) combined with network access makes this exploitable by any unauthenticated remote attacker, but the actual impact depends on whether Silex or downstream systems validate file integrity (signatures, checksums) before applying uploads - if such checks exist, the vulnerability is primarily a denial-of-service or information disclosure vector rather than code execution. Organizations running these products should treat this as a high-priority patching target due to the ease of exploitation (AC:L), despite the moderate CVSS score.

A remote attacker sends an HTTP POST request containing a crafted firmware file or payload to the firmware maintenance endpoint of an exposed SD-330AC or AMC Manager instance (e.g., http://device-ip/firmware/upload or similar), and the request is accepted without authentication. If the device does not validate file signatures or checksums, the attacker's file may be stored or partially processed, potentially corrupting the device or enabling follow-up code execution if the file is later mishandled.