CRITICAL: Silex Technology Devices Vulnerable to Remote Code Execution

The National Vulnerability Database has disclosed a critical heap-based buffer overflow, CVE-2026-32956, impacting silex technology, Inc.’s SD-330AC and AMC Manager. This vulnerability, rated 9.8 CVSS, stems from improper processing of redirect URLs, creating an avenue for attackers to execute arbitrary code remotely on affected devices.

This isn’t just a denial-of-service risk; it’s a full compromise. A successful exploit could grant an unauthenticated attacker complete control over the device. Given the network-facing nature of these products, the attack surface is broad, making this a prime target for initial access or lateral movement within an environment.

Defenders need to treat this with extreme urgency. The ability to achieve arbitrary code execution without authentication (AV:N, PR:N, UI:N) means these devices are exposed directly to the internet if not properly segmented. This is exactly the kind of vulnerability threat actors love to weaponize for botnets or as a foothold into corporate networks.