SB2026042064 - Multiple vulnerabilities in silex technology SD-330AC and AMC Manager
Published: April 20, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 secuirty vulnerabilities.
1) Remote code execution (CVE-ID: CVE-2015-5621)
The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.The weakness exists due to the snmp_pdu_parse function in snmp_api.c does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails. A remote attacker can supply specially crafted input and cause denial of service or execute arbitrary code with elevated privileges.
2) Stack-based buffer overflow (CVE-ID: CVE-2026-32955)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in processing the redirect URLs. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Heap-based buffer overflow (CVE-ID: CVE-2026-32956)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in processing the redirect URLs. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Missing Authentication for Critical Function (CVE-ID: CVE-2026-32957)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to missing authentication for critical function on firmware maintenance. A remote attacker can upload arbitrary file on the device without authentication.
5) Use of hard-coded cryptographic key (CVE-ID: CVE-2026-32958)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to use of hard-coded cryptographic key. A remote attacker can direct a victim to apply a fake firmware update.
6) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2026-32959)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to use of a broken or risky cryptographic algorithm. A remote attacker can perform a man-in-the-middle (MitM) attack and gain access to sensitive information on the system.
7) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-32960)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to sensitive information in resource not removed before reuse. A remote attacker can send a specially crafted packet and login to the device without knowing the password.
8) Heap-based buffer overflow (CVE-ID: CVE-2026-32961)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in packet data processing of sx_smpd. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and cause a denial of service condition on the target system.
9) Missing Authentication for Critical Function (CVE-ID: CVE-2026-32962)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to missing authentication for critical device setting function. A remote attacker can alter device configuration without authentication.
10) Cross-site scripting (CVE-ID: CVE-2026-32963)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
11) CRLF injection (CVE-ID: CVE-2026-32964)
The vulnerability allows a remote attacker to inject arbitrary data in server response.
The vulnerability exists due to insufficient validation of attacker-supplied data. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.
12) Insecure Default Initialization of Resource (CVE-ID: CVE-2026-32965)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to initialization of a resource with an insecure default. A remote attacker can configure the device with the null string password.
13) Incorrect Privilege Assignment (CVE-ID: CVE-2024-24487)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to incorrect privilege assignment. A remote attacker can reboot the affected device.
Remediation
Install update from vendor's website.