CVE-2026-32965

CVE-2026-32965 is an initialization vulnerability affecting Silex Technology's SD-330AC and AMC Manager devices that allows them to be configured with a null string (blank) password when deployed with factory-default settings. This insecure default configuration creates an authentication bypass condition for networked instances of these products. The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector that requires no authentication or user interaction, indicating it can be exploited remotely by unauthenticated threat actors. While the vulnerability does not compromise confidentiality or availability, it enables high-impact integrity violations through unauthorized device configuration. There is currently no evidence of active exploitation in the wild, as the vulnerability is not included on CISA's Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. The EPSS score of 0.00029 indicates this threat ranks below average in terms of real-world exploitation probability relative to other disclosed vulnerabilities, though organizations running these devices should still prioritize remediation by changing default credentials immediately upon deployment.