Hard-Coded Key in Silex SD-330AC Enables Firmware Spoofing

Publication date: 2026-04-20

Last updated on: 2026-04-22

Assigner: JPCERT/CC

Description

SD-330AC and AMC Manager provided by silex technology, Inc. use a hard-coded cryptographic key. An administrative user may be directed to apply a fake firmware update.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-20

Last Modified

2026-04-22

Generated

2026-07-06

AI Q&A

2026-04-20

EPSS Evaluated

2026-07-05

NVD

CVE-2026-32958

EUVD

EUVD-2026-23751

Affected Vendors & Products

Vendor	Product	Version / Range
silextechnology	sd-330ac_firmware	to 1.50 (exc)
silextechnology	amc_manager	to 5.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability involves the SD-330AC and AMC Manager products from silex technology, Inc., which use a hard-coded cryptographic key. Because of this, an administrative user could be tricked into applying a fake firmware update.

Impact Analysis

The impact of this vulnerability is that an attacker could potentially cause an administrative user to install a malicious firmware update. This could lead to unauthorized changes or compromise of the affected device's integrity.

Hi! I’m here to help you understand CVE-2026-32958. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70