A critical vulnerability in Silex Technology SD-330AC and AMC Manager devices allows unauthenticated attackers to set null passwords, risking full administrative control over device configurations.

This flaw involves the initialization of a resource with an insecure default, specifically allowing the assignment of a null string password during device setup. An unauthenticated attacker can exploit this via the network to bypass authentication controls.

Successful exploitation allows an attacker to gain unauthorized control over affected devices, potentially leading to unauthorized configuration changes or full compromise of the device functionality. Given the CVSS score of 7.5, this high-severity vulnerability poses a significant risk to network integrity and operational availability, particularly for industrial or management-grade hardware.

Immediate Action: Consult the official Silex Technology security advisory at https://www.silex.jp/support/security-advisories/en/2026-001 to identify if firmware updates are available for your specific deployment. If no update is available, immediately change the default factory password to a strong, unique credential.

Proactive Monitoring: Monitor network traffic for unauthorized attempts to access device management interfaces and review system logs for configuration change events.

Compensating Controls: Restrict access to device management interfaces by placing them behind a secure management VLAN or firewall, ensuring they are not exposed to the public internet.

Public Exploit Available: No (exploit_available: unknown)

The reliance on insecure default credentials represents a severe security oversight that must be remediated immediately. Administrators should verify the configuration of all deployed SD-330AC and AMC Manager units, enforce strong password policies, and apply vendor-provided patches as soon as they are released to prevent unauthorized access.