Login Request a demo
Critical severity · published Feb 27, 2026
CVE-2026-27751
SODOLA SL902-SWTGW124AS <= 200.1.20 Use of Default Credentials
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative access to the management interface. Attackers can authenticate using the hardcoded default credentials without password change enforcement to gain full administrative control of the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
SODOLA SL902-SWTGW124AS · Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks)
through 200.1.20 · source: vendor
SF
Sl902-swtgw124as Firmware · Sodola-network
through 200.1.20 · source: NVD
Affected product
SS
SODOLA SL902-SWTGW124AS
Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27751
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27751
Product
https://www.sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch
Third Party Advisory
https://www.vulncheck.com/advisories/sodola-sl902-swtgw124as-use-of-default-credentials
More from SODOLA SL902-SWTGW124AS
9.8
CVE-2026-27755
SODOLA SL902-SWTGW124AS <= 200.1.20 Predictable Session ID
7.2
CVE-2026-27757
SODOLA SL902-SWTGW124AS <= 200.1.20 Unverified Password Change
6.5
CVE-2026-27758
SODOLA SL902-SWTGW124AS <= 200.1.20 Missing CSRF Protections
6.5
CVE-2026-27754
SODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token Generation
6.5
CVE-2026-27753
SODOLA SL902-SWTGW124AS <= 200.1.20 Improper Login Rate Limiting