Sd 330Ac EUVD-2026-23754

Q: What is the CVSS score of EUVD-2026-23754?

EUVD-2026-23754 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-32961 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-04-20 jpcert

GHSA-23v2-6gx7-7pp6

Heap Overflow Buffer Overflow Sd 330Ac Amc Manager

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 20, 2026 - 04:22 NVD

5.3 (MEDIUM) 6.9 (MEDIUM)

Analysis Generated

Apr 20, 2026 - 04:10 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 04:00 euvd

EUVD-2026-23754

Analysis Generated

Apr 20, 2026 - 04:00 vuln.today

CVE Published

Apr 20, 2026 - 03:18 nvd

MEDIUM 6.9

DescriptionCVE.org

SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in packet data processing of sx_smpd. Processing a crafted packet may cause a temporary denial-of-service (DoS) condition.

AnalysisAI

Heap-based buffer overflow in Silex SD-330AC and AMC Manager packet processing allows remote unauthenticated attackers to trigger a temporary denial-of-service condition via crafted network packets to the sx_smpd service. CVSS score is 5.3 (moderate) with confirmed active reporting by JPCERT, though no public exploit code or CISA KEV listing is evident from available data. Attack requires only network access and no authentication or user interaction.

Technical ContextAI

The vulnerability resides in the sx_smpd (Silex SD management protocol daemon) component, which handles packet data processing for the Silex SD-330AC device and AMC Manager software. The heap-based buffer overflow (CWE-122) occurs when processing specially crafted network packets, likely due to insufficient bounds checking on input data written to heap-allocated memory. This memory corruption can corrupt heap metadata or adjacent objects, leading to application crash or unexpected behavior. The SD-330AC is a network device (likely a secure digital/storage appliance based on Silex product lines), and AMC Manager is its management software; both expose the vulnerable sx_smpd service over the network without requiring authentication.

RemediationAI

Contact Silex Technology, Inc. and obtain the patched firmware/software version for SD-330AC and AMC Manager as detailed in advisory 2026-001 at https://www.silex.jp/support/security-advisories/en/2026-001. Exact patched version numbers are not specified in the CVE record; refer directly to the vendor advisory for version-to-patch mapping. As a temporary compensating control, restrict network access to the sx_smpd service (typically running on a specific port on SD-330AC) by implementing firewall rules to permit connections only from authorized management hosts; this reduces the attack surface significantly since DoS impact is localized to the affected device and does not propagate. Alternatively, isolate SD-330AC and AMC Manager management traffic to a dedicated management VLAN with restricted ingress filtering. Note that these controls do not eliminate the vulnerability, only reduce exposure-patching is required for full remediation.