JVNDB-2026-012056
Vulnerability from jvndb - Published: 2026-04-21 06:27 - Updated:2026-04-23 08:57
Severity
Summary
Multiple vulnerabilities in silex technology SD-330AC and AMC Manager
Details
SD-330AC and AMC Manager provided by silex technology, Inc. contain multiple vulnerabilities listed below.
- Stack-based buffer overflow in processing the redirect URLs (CWE-121) - CVE-2026-32955
- Heap-based buffer overflow in processing the redirect URLs (CWE-122) - CVE-2026-32956
- Missing authentication for critical function on firmware maintenance (CWE-306) - CVE-2026-32957
- Use of hard-coded cryptographic key (CWE-321) - CVE-2026-32958
- Use of a broken or risky cryptographic algorithm (CWE-327) - CVE-2026-32959
- Sensitive information in resource not removed before reuse (CWE-226) - CVE-2026-32960
- Heap-based buffer overflow in packet data processing of sx_smpd (CWE-122) - CVE-2026-32961
- Missing authentication for critical device setting function (CWE-306) - CVE-2026-32962
- Reflected cross-site scripting (CWE-79) - CVE-2026-32963
- CRLF injection (CWE-93) - CVE-2026-32964
- Initialization of a resource with an insecure default (CWE-1188) - CVE-2026-32965
- Dependency on vulnerable third-party component (CWE-1395) - CVE-2015-5621
- Incorrect privilege assignment (CWE-266) - CVE-2024-24487
References
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-012056.html",
"dc:date": "2026-04-23T17:57+09:00",
"dcterms:issued": "2026-04-21T15:27+09:00",
"dcterms:modified": "2026-04-23T17:57+09:00",
"description": "SD-330AC and AMC Manager provided by silex technology, Inc. contain multiple vulnerabilities listed below.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/121.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/122.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/306.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/321.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/327.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/226.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/122.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/306.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/79.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/93.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/1188.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/1395.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/266.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eStack-based buffer overflow in processing the redirect URLs (CWE-121) - CVE-2026-32955\u003c/li\u003e\u003cli\u003eHeap-based buffer overflow in processing the redirect URLs (CWE-122) - CVE-2026-32956\u003c/li\u003e\u003cli\u003eMissing authentication for critical function on firmware maintenance (CWE-306) - CVE-2026-32957\u003c/li\u003e\u003cli\u003eUse of hard-coded cryptographic key (CWE-321) - CVE-2026-32958\u003c/li\u003e\u003cli\u003eUse of a broken or risky cryptographic algorithm (CWE-327) - CVE-2026-32959\u003c/li\u003e\u003cli\u003eSensitive information in resource not removed before reuse (CWE-226) - CVE-2026-32960\u003c/li\u003e\u003cli\u003eHeap-based buffer overflow in packet data processing of sx_smpd (CWE-122) - CVE-2026-32961\u003c/li\u003e\u003cli\u003eMissing authentication for critical device setting function (CWE-306) - CVE-2026-32962\u003c/li\u003e\u003cli\u003eReflected cross-site scripting (CWE-79) - CVE-2026-32963\u003c/li\u003e\u003cli\u003eCRLF injection (CWE-93) - CVE-2026-32964\u003c/li\u003e\u003cli\u003eInitialization of a resource with an insecure default (CWE-1188) - CVE-2026-32965\u003c/li\u003e\u003cli\u003eDependency on vulnerable third-party component (CWE-1395) - CVE-2015-5621\u003c/li\u003e\u003cli\u003eIncorrect privilege assignment (CWE-266) - CVE-2024-24487\u003c/li\u003e\u003c/ul\u003eFrancesco La Spina of Forescout Technologies reported these vulnerabilities to CISA ICS. At the request of CISA ICS, JPCERT/CC coordinated with the developer.",
"link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-012056.html",
"sec:cpe": [
{
"#text": "cpe:/a:silex:amc_manager",
"@product": "AMC Manager",
"@vendor": "silex technology",
"@version": "2.2"
},
{
"#text": "cpe:/h:silex:sd_330ac",
"@product": "SD-330AC",
"@vendor": "silex technology",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "8.8",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2026-012056",
"sec:references": [
{
"#text": "https://jvn.jp/en/vu/JVNVU94271449/index.html",
"@id": "JVNVU#94271449",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2015-5621",
"@id": "CVE-2015-5621",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-24487",
"@id": "CVE-2024-24487",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-32955",
"@id": "CVE-2026-32955",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-32956",
"@id": "CVE-2026-32956",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-32957",
"@id": "CVE-2026-32957",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-32958",
"@id": "CVE-2026-32958",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-32959",
"@id": "CVE-2026-32959",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-32960",
"@id": "CVE-2026-32960",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-32961",
"@id": "CVE-2026-32961",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-32962",
"@id": "CVE-2026-32962",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-32963",
"@id": "CVE-2026-32963",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-32964",
"@id": "CVE-2026-32964",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-32965",
"@id": "CVE-2026-32965",
"@source": "CVE"
},
{
"#text": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-10",
"@id": "ICSA-26-111-10",
"@source": "ICS-CERT ADVISORY"
},
{
"#text": "https://cwe.mitre.org/data/definitions/1188.html",
"@id": "CWE-1188",
"@title": "Insecure Default Initialization of Resource(CWE-1188)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/121.html",
"@id": "CWE-121",
"@title": "Stack-based Buffer Overflow(CWE-121)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/122.html",
"@id": "CWE-122",
"@title": "Heap-based Buffer Overflow(CWE-122)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/1395.html",
"@id": "CWE-1395",
"@title": "Dependency on Vulnerable Third-Party Component(CWE-1395)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/226.html",
"@id": "CWE-226",
"@title": "Sensitive Information in Resource Not Removed Before Reuse(CWE-226)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/266.html",
"@id": "CWE-266",
"@title": "Incorrect Privilege Assignment(CWE-266)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/306.html",
"@id": "CWE-306",
"@title": "Missing Authentication for Critical Function(CWE-306)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/321.html",
"@id": "CWE-321",
"@title": "Use of Hard-coded Cryptographic Key(CWE-321)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/327.html",
"@id": "CWE-327",
"@title": "Use of a Broken or Risky Cryptographic Algorithm(CWE-327)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-79",
"@title": "Cross-site Scripting(CWE-79)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/93.html",
"@id": "CWE-93",
"@title": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)(CWE-93)"
}
],
"title": "Multiple vulnerabilities in silex technology SD-330AC and AMC Manager"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…