SD-330AC (Ver. 1.42 and earlier) and AMC Manager (Ver. 5.0.2 and earlier) provided by Silex Technology, Inc. contain a heap-based buffer overflow vulnerability in processing redirect URLs.
Attackers can execute arbitrary code on affected devices without authentication or user interaction. This could allow complete device compromise, including unauthorized configuration modifications, data access, and potential lateral movement within connected networks. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) with high impacts to confidentiality, integrity, and availability.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. Patches have been released by Silex Technology, Inc. and are referenced in their security advisory (2026-001).
Update SD-330AC to a version later than Ver. 1.42 and AMC Manager to a version later than Ver. 5.0.2. Prioritize patching immediately given the critical severity rating. As an interim measure, restrict network access to these devices and disable redirect URL processing features if operationally feasible until patches can be applied.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Feedly found the first article mentioning CVE-2026-32956 . See article
NVD published the first details for CVE-2026-32956
A CVSS base score of 9.8 has been assigned.
GitHub Advisories released a security advisory .
CVE-2026-32956 is a critical heap-based buffer overflow vulnerability in the Silex SD-330AC device and AMC Manager software, with a CVSS score of 9.8, allowing unauthenticated remote attackers to execute arbitrary code without user interaction. While the article does not mention exploitation in the wild or proof-of-concept exploits, it emphasizes the urgency of applying the official patches provided by Silex technology, Inc., and suggests interim mitigations such as restricting network access. There are no indications of downstream impacts on other third-party vendors or technologies mentioned in the article. See article
CVE-2026-32956 - Silex Technology, Inc. SD-330AC and AMC Manager Heap-Based Buffer Overflow Vulnerability CVE ID : CVE-2026-32956 Published : April 20, 2026, 4:16 a.m. | 1 hour, 41 minutes ago Description : SD-330AC and AMC Manager provided by silex technology, Inc. cont...
CVE-2026-32956: Silex Technology, Inc. SD-330AC - Buffer Overflow [CRITICAL] CVSS 9.8
CVE-2026-32956 | silex SD-330AC/AMC Manager Redirect URL heap-based overflow
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
