Amc Manager EUVD-2026-23755

Exploitation requires the SD-330AC or AMC Manager to be network-accessible (directly or via management network) and the target functions must be exposed without authentication. No special configuration is required - the vulnerability exists in default deployments. Limiting factors: the attacker must know or discover the IP address and management interface port of the device, and must be able to reach it over the network; if the device is isolated on an internal-only network without internet routing, network-based attacks are prevented. The impact is limited to configuration integrity; the attacker cannot read sensitive data (confidentiality unaffected per CVSS) nor directly disable the device (availability unaffected).

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms network-accessible unauthenticated access with low attack complexity and no user interaction required, placing the attack surface at maximum exposure. However, the integrity impact is rated 'Low' (I:L) rather than 'High,' and confidentiality and availability are unaffected, resulting in a moderate 5.3 score. The practical risk depends on what 'device configuration' entails: if it includes disabling security features, redirecting traffic, or exfiltrating logs, the real impact could exceed the CVSS rating. Conversely, if configuration changes are easily reversible or monitored, risk is lower. No KEV status, active exploitation reports, or public POC have been identified, suggesting this is either nascent or affects a niche product. Organizations using SD-330AC or AMC Manager should prioritize assessment of what configurations are exposed; this is a high-likelihood/medium-impact authentication bypass rather than a low-probability attack.

An attacker on the network sends an unauthenticated HTTP or API request to the SD-330AC or AMC Manager management endpoint, specifying a configuration change such as modifying network settings, disabling logging, or altering security policies. The request is accepted without credential verification and the configuration is altered. The attacker causes the device to behave maliciously or to stop enforcing security controls, potentially enabling lateral movement, data exfiltration, or disruption.