Which versions of Sd 330Ac are affected by EUVD-2026-23753?

Silex Technology SD-330AC access points and AMC Manager contain an authentication bypass vulnerability allowing remote attackers to obtain unauthorized administrative access through crafted network…

How to fix or mitigate EUVD-2026-23753?

Within 24 hours: Identify and inventory all Silex SD-330AC access points and AMC Manager instances in your environment. Within 7 days: Isolate affected devices to restricted network segments and disable remote administrative access where operationally feasible; contact Silex Technology for patch availability and timeline. Within 30 days: Apply vendor-released patch immediately upon availability; if patch remains unavailable, implement network-level controls restricting access to management interfaces to authorized IP ranges only.

Sd 330Ac EUVD-2026-23753

Q: What is the CVSS score of EUVD-2026-23753?

EUVD-2026-23753 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-32960 HIGH

Sensitive Information in Resource Not Removed Before Reuse (CWE-226)

2026-04-20 jpcert

GHSA-g7hc-x6qw-m35g

Information Disclosure Sd 330Ac Amc Manager

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Apr 20, 2026 - 04:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 20, 2026 - 04:22 vuln.today

cvss_changed

Severity Changed

Apr 20, 2026 - 04:22 NVD

MEDIUM HIGH

CVSS changed

Apr 20, 2026 - 04:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Apr 20, 2026 - 04:10 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 04:00 euvd

EUVD-2026-23753

Analysis Generated

Apr 20, 2026 - 04:00 vuln.today

CVE Published

Apr 20, 2026 - 03:18 nvd

HIGH 7.1

DescriptionCVE.org

SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive information in resource not removed before reuse. An attacker may login to the device without knowing the password by sending a crafted packet.

AnalysisAI

Authentication bypass in silex technology SD-330AC (≤1.42) and AMC Manager (≤5.0.2) allows remote attackers to gain unauthorized access by sending specially crafted packets that exploit residual sensitive data in memory. Attacker can log in without valid credentials due to improper clearance of authentication tokens or session data between requests. EPSS score of 0.03% (7th percentile) indicates low observed exploitation probability. JPCERT/CC reported this vulnerability, and vendor advisory confirms patches are available. Requires user interaction (CVSS 4.0 UI:P), limiting automated exploitation.

Technical ContextAI

This vulnerability affects silex technology's SD-330AC wireless access point/bridge device and AMC Manager network management software. The root cause is CWE-226 (Sensitive Information in Resource Not Removed Before Reuse), a memory management flaw where authentication credentials, session tokens, or cryptographic material persist in allocated memory after use. When processing subsequent requests, the application reuses this memory without proper sanitization, allowing attackers to craft packets that trigger authentication logic to reference stale credential data. The CVSS 4.0 vector indicates network-accessible exploitation with low complexity but requires user interaction, suggesting the attack may need timing coordination with legitimate user activity or social engineering to trigger the vulnerable code path. CPE identifiers confirm both products share the same underlying authentication framework prone to this memory hygiene issue.

RemediationAI

Upgrade SD-330AC devices to firmware version 1.43 or later, and upgrade AMC Manager to version 5.0.3 or later per silex technology security advisory 2026-001 (https://www.silex.jp/support/security-advisories/en/2026-001). Patches address the memory sanitization issue by implementing proper clearing of authentication buffers after each session. If immediate patching is not feasible, implement network segmentation to restrict access to SD-330AC and AMC Manager interfaces to trusted management VLANs only - do NOT expose administrative interfaces to general corporate networks or the internet. Deploy strict firewall rules permitting connections only from dedicated jump hosts or management workstations with known IP addresses. Enable authentication logging and monitor for repeated failed login attempts followed by unexplained successful logins, which may indicate exploitation attempts. Note that network restrictions reduce attack surface but do not eliminate the vulnerability - insider threats or lateral movement scenarios remain exploitable until patching is complete. Review authentication logs from 60 days prior to patching for anomalous login patterns.