CVE-2026-32965 silex technology, Inc. CVE debrief

Who should care

Organizations that deploy or manage Silex Technology SD-330AC devices and AMC Manager, especially teams responsible for OT/ICS network administration, device provisioning, and configuration hardening. Anyone operating factory-default installations should prioritize this immediately.

Technical summary

The advisory describes an Initialization of a Resource with an Insecure Default weakness. Impacted products are Silex Technology SD-330AC firmware versions up to 1.42 and AMC Manager versions up to 5.0.2. The issue is exploitable in the factory-default configuration, where a null-string password may permit configuration access. CISA lists a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N with a score of 7.5, indicating network-reachable unauthorized configuration impact without user interaction.

Defensive priority

High. The combination of default-configuration exposure, no required privileges, and direct configuration impact makes this a priority for immediate password-hardening and upgrade planning, especially on any externally reachable or broadly reachable management interface.

Recommended defensive actions

• Update SD-330AC firmware to version 1.50 or later.
• Update AMC Manager to version 5.1.0 or later.
• Set a strong password for the settings web interface, especially on any device still in factory-default configuration.
• Inventory deployed Silex Technology SD-330AC and AMC Manager instances to identify versions at or below the affected releases.
• Restrict access to device management interfaces to trusted administrative networks until remediation is complete.
• Validate remediation by confirming installed versions and verifying that the settings web interface no longer accepts a null-string password.

Evidence notes

All core facts are drawn from the supplied CISA CSAF advisory for ICSA-26-111-10 and the embedded CVE metadata. The advisory states the affected products and versions, the insecure-default/null-string-password behavior, and the vendor fix versions. The supplied CVSS vector and score are 7.5 / AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The advisory publication date and CVE publication date both resolve to 2026-04-21T06:00:00.000Z.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.