CVE-2026-32964

MediumCVSS 6.5/10Last modified Oct 26, 2026

Description

SD-330AC and AMC Manager provided by silex technology, Inc. contain an improper neutralization of CRLF sequences ('CRLF Injection') vulnerability. Processing some crafted configuration data may lead to arbitrary entries injected to the system configuration.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-93

Affected software

Vendor	Product	Versions
silex technology, Inc.	SD-330AC	Ver.1.42 and earlier
silex technology, Inc.	AMC Manager	Ver.5.0.2 and earlier

References

https://jvn.jp/en/vu/JVNVU94271449/Third Party Advisory
https://www.silex.jp/support/security-advisories/2026-001Vendor Advisory
https://www.silex.jp/support/security-advisories/en/2026-001Vendor Advisory

Timeline

Published: Apr 20, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-329657.5Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex technology, Inc. Wh CVE-2026-329669.8DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affect CVE-2026-329679.1Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinSchedule CVE-2026-329689.8Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerab CVE-2026-329697.5An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method CVE-2026-32976.4The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor CVE-2026-329703.3OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password CVE-2026-329718.0OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell paylo CVE-2026-329727.1OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permissio CVE-2026-329739.8OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns w CVE-2026-329749.8OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured w CVE-2026-329759.8OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names in