SD‑330AC and AMC Manager use a fixed cryptographic key, enabling an attacker to replace legitimate firmware with a malicious image that the system will accept without verification. This flaw, categorized as CWE‑321 (Weak Cryptographic Key), can allow arbitrary code execution or unauthorized control of the device, as the compromised firmware runs with the same privileges as authentic updates.

The vulnerability affects Silex technology, Inc.'s AMC Manager and SD‑330AC devices that contain the hard‑coded cryptographic key. No specific version information is provided, indicating that all current releases of these products are potentially susceptible.

With a CVSS score of 6.9 the flaw carries medium severity. The EPSS score is not available and it is not listed in the CISA KEV catalog, indicating that no current data informs the likelihood of exploitation. The likely attack vector, inferred from the description, involves a social engineering or remote delivery of a fake firmware update; however, this specific vector is not explicitly stated in the input.