PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32957 silex technology, Inc. CVE debrief

CVE-2026-32957 is a medium-severity authentication flaw in Silex Technology SD-330AC and AMC Manager. According to CISA's advisory, the issue could allow uploads of arbitrary files to the device without authentication. The supplied advisory data lists fixed versions and recommends disabling HTTP/HTTPS service as an interim mitigation.

Vendor
silex technology, Inc.
Product
Silex Technology SD-330AC <=1.42 AMC Manager <=5.0.2
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-21
Original CVE updated
2026-04-21
Advisory published
2026-04-21
Advisory updated
2026-04-21

Who should care

Administrators and operators responsible for Silex Technology SD-330AC appliances and AMC Manager deployments, especially where the management interface is reachable over HTTP/HTTPS.

Technical summary

CISA's CSAF advisory for ICSA-26-111-10 describes a Missing Authentication for Critical Function issue affecting Silex Technology SD-330AC firmware versions up to 1.42 and AMC Manager versions up to 5.0.2. The stated impact is that an attacker can upload arbitrary files to the device without authentication. The advisory lists SD-330AC firmware 1.50 or later and AMC Manager 5.1.0 or later as vendor fixes, and also recommends disabling HTTP/HTTPS service as a mitigation.

Defensive priority

Medium. Prioritize remediation for any exposed or operationally important device because the flaw is unauthenticated and affects device integrity.

Recommended defensive actions

  • Inventory Silex Technology SD-330AC and AMC Manager deployments and identify any systems running SD-330AC firmware 1.42 or earlier or AMC Manager 5.0.2 or earlier.
  • Upgrade SD-330AC to firmware version 1.50 or later.
  • Upgrade AMC Manager to version 5.1.0 or later.
  • If immediate upgrading is not possible, disable HTTP/HTTPS service as CISA recommends for this issue set.
  • Verify the vendor and JPCERT/CC advisories linked from the CISA record for deployment-specific guidance.

Evidence notes

The source corpus is the CISA CSAF advisory ICSA-26-111-10, published 2026-04-21T06:00:00Z, with the same modified timestamp in the supplied record. The advisory explicitly states the unauthenticated arbitrary file upload condition and lists remediation versions and mitigation text. The supplied SSVCv2 timestamp is 2026-04-20T06:00:00Z and should be treated as assessment context, not the issue date. No KEV listing is present in the provided data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-32957 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-32957

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-32957 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32957

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-111-10.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-10

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.