Skip to main content

Sd 330Ac EUVDEUVD-2026-23755

| CVE-2026-32962 MEDIUM
Missing Authentication for Critical Function (CWE-306)
2026-04-20 jpcert GHSA-mmj2-4xv2-5qh8
Authentication Bypass Sd 330Ac Amc Manager
6.9
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
CVSS changed
Apr 20, 2026 - 04:22 NVD
5.3 (MEDIUM) 6.9 (MEDIUM)
Analysis Generated
Apr 20, 2026 - 04:09 vuln.today
EUVD ID Assigned
Apr 20, 2026 - 04:00 euvd
EUVD-2026-23755
Analysis Generated
Apr 20, 2026 - 04:00 vuln.today
CVE Published
Apr 20, 2026 - 03:18 nvd
MEDIUM 6.9

DescriptionCVE.org

SD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for critical function issue. The device configuration may be altered without authentication.

AnalysisAI

SD-330AC and AMC Manager by Silex Technology lack authentication controls on critical configuration functions, allowing remote attackers to modify device settings without credentials. The CVSS score of 5.3 reflects network-accessible integrity impact with no complexity barrier, though confidentiality and availability are not directly affected. No active exploitation has been confirmed in CISA KEV or public exploit repositories at the time of analysis.

Technical ContextAI

The SD-330AC is a network device and AMC Manager is an administrative management application produced by Silex Technology. Both products expose configuration functions across the network without enforcing authentication checks, a violation of CWE-306 (Missing Authentication for Critical Function). This root cause indicates that critical administrative operations - such as modifying device settings, network parameters, or management configurations - are accessible via unauthenticated API endpoints or web interfaces. The CVE affects all versions of both products according to available CPE data, suggesting the vulnerability is endemic to the product design rather than introduced in a specific release.

RemediationAI

Consult Silex Technology's security advisories (https://www.silex.jp/support/security-advisories/en/2026-001) for patched firmware or software versions; specific fix versions are not confirmed in available data. As an interim compensating control, restrict network access to SD-330AC and AMC Manager management interfaces using firewall rules or network segmentation - permit only connections from trusted administrative subnets and block unauthenticated access from untrusted networks. Monitor configuration changes via access logs if the product supports them, and document current baseline configurations so unauthorized modifications are detectable. If the product supports authentication configuration, enable it immediately and enforce strong credentials. These mitigations reduce exposure but do not eliminate the underlying design flaw; patching remains the primary remediation once available.

More in Sd 330Ac

View all
CVE-2026-32956 CRITICAL
9.3 Apr 20

Remote code execution in silex technology SD-330AC and AMC Manager allows unauthenticated network attackers to execute a
CVE-2026-32955 HIGH
8.7 Apr 20

Stack-based buffer overflow in silex technology's SD-330AC (Ver.1.42 and earlier) and AMC Manager (Ver.5.0.2 and earlier
CVE-2026-32965 HIGH
8.7 Apr 20

SD-330AC wireless LAN modules and AMC Manager devices from silex technology allow unauthenticated remote attackers to mo
CVE-2026-32959 HIGH
8.2 Apr 20

Weak cryptographic implementation in Silex Technology SD-330AC wireless LAN adapters (v1.42 and earlier) and AMC Manager
CVE-2026-32960 HIGH
7.1 Apr 20

Authentication bypass in silex technology SD-330AC (≤1.42) and AMC Manager (≤5.0.2) allows remote attackers to gain unau
CVE-2026-32957 MEDIUM
6.9 Apr 20

Unauthenticated arbitrary file upload in Silex Technology SD-330AC and AMC Manager firmware maintenance functions allows
CVE-2026-32964 MEDIUM
6.9 Apr 20

CRLF injection in Silex Technology SD-330AC and AMC Manager allows unauthenticated remote attackers to inject arbitrary

CVE-2026-32961 MEDIUM
6.9 Apr 20

Heap-based buffer overflow in Silex SD-330AC and AMC Manager packet processing allows remote unauthenticated attackers t
CVE-2026-32958 MEDIUM
6.9 Apr 20

Hard-coded cryptographic keys in Silex Technology SD-330AC and AMC Manager enable attackers to forge firmware updates th
CVE-2026-32963 MEDIUM
5.1 Apr 20

Reflected cross-site scripting (XSS) in Silex Technology SD-330AC and AMC Manager allows remote attackers to execute arb

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2024-51567 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-32433 CRITICAL POC
10.0
CVE-2016-2004 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-23755 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy