CVE-2026-32960

Authentication Bypass via Sensitive Resource Reuse in Silex AMC Manager and SD-330AC

Published Apr 20, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive information in resource not removed before reuse. An attacker may login to the device without knowing the password by sending a crafted packet.

Analysis

Technical impact

The vulnerability in Silex Technology's AMC Manager and SD-330AC allows an attacker to authenticate to the device without knowing the correct password by sending a specially crafted packet. This bypass results in unauthorized access, enabling the attacker to control the device's configuration and settings. The weakness is a flaw in resource handling where sensitive data is not removed before reuse, a classic instance of CWE-226.

Affected Systems

Silex Technology, Inc. provides AMC Manager and SD-330AC. No specific firmware or hardware revision is mentioned, and version details are not supplied. The products are affected by the flaw regardless of any particular sub-version, so all deployments using these devices should consider themselves potentially vulnerable.

Risk and Exploitability

With a CVSS score of 7.1, this vulnerability is of medium‑to‑high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Attackers can exploit the issue remotely over the network by sending a crafted packet to the device, making the vulnerability potentially reachable in environments with exposed management interfaces.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

silex technology, Inc.

SD-330AC

affected

Version	Status	Constraints
`Ver.1.42 and earlier`	affected	—

silex technology, Inc.

AMC Manager

affected

Version	Status	Constraints
`Ver.5.0.2 and earlier`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:silextechnology:sd-330ac_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:silextechnology:sd-330ac:-:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:a:silextechnology:amc_manager:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Silextechnology

Amc Manager

Version	Status	Scheme	Platform
`[0,5.0.2]`	affected	semver	—

Silextechnology

Sd-330ac

Version	Status	Scheme	Platform
`[0,1.42]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Obtain and apply the latest firmware or software update from Silex Technology that addresses the authentication bypass.
Restrict management access by enabling firewalls or VLAN segmentation to limit who can reach the device from untrusted networks.
Regularly review device logs for signs of unauthorized login attempts and consider disabling unused management protocols if possible.

Generated by OpenCVE AI on April 20, 2026 at 06:22 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.260% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://jvn.jp/en/vu/JVNVU94271449/
https://www.silex.jp/support/security-advisories/2026-001
https://www.silex.jp/support/security-advisories/en/2026-001

History

Apr 22, 2026 5:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Silextechnology sd-330ac Firmware
CPEs		cpe:2.3:a:silextechnology:amc_manager:::::::: cpe:2.3:h:silextechnology:sd-330ac:-:::::::* cpe:2.3:o:silextechnology:sd-330ac_firmware::::::::
Vendors & Products		Silextechnology sd-330ac Firmware

Apr 20, 2026 3:15 PM First appearance in the feed. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Silextechnology Silextechnology amc Manager Silextechnology sd-330ac
Vendors & Products		Silextechnology Silextechnology amc Manager Silextechnology sd-330ac
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 20, 2026 6:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		Authentication Bypass via Sensitive Resource Reuse in Silex AMC Manager and SD-330AC

Apr 20, 2026 4:00 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive information in resource not removed before reuse. An attacker may login to the device without knowing the password by sending a crafted packet.
Weaknesses		CWE-226
References		https://jvn.jp/en/vu/JVNVU94271449/ https://www.silex.jp/support/security-advisories/2026-001 https://www.silex.jp/support/security-advisories/en/2026-001
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}`