Login Request a demo
Medium severity · published Feb 27, 2026
CVE-2026-27754
SODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token Generation
6.5
CVSS
0.1%
EPSS
No
On KEV
Description
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 use the cryptographically broken MD5 hash function for session cookie generation, weakening session security. Attackers can exploit predictable session tokens combined with MD5's collision vulnerabilities to forge valid session cookies and gain unauthorized access to the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
SODOLA SL902-SWTGW124AS · Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks)
through 200.1.20 · source: vendor
SF
Sl902-swtgw124as Firmware · Sodola-network
through 200.1.20 · source: NVD
Affected product
SS
SODOLA SL902-SWTGW124AS
Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27754
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27754
Product
https://www.sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch
Third Party Advisory
https://www.vulncheck.com/advisories/sodola-sl902-swtgw124as-md5-session-token-generation
More from SODOLA SL902-SWTGW124AS
9.8
CVE-2026-27755
SODOLA SL902-SWTGW124AS <= 200.1.20 Predictable Session ID
9.8
CVE-2026-27751
SODOLA SL902-SWTGW124AS <= 200.1.20 Use of Default Credentials
7.2
CVE-2026-27757
SODOLA SL902-SWTGW124AS <= 200.1.20 Unverified Password Change
6.5
CVE-2026-27758
SODOLA SL902-SWTGW124AS <= 200.1.20 Missing CSRF Protections
6.5
CVE-2026-27753
SODOLA SL902-SWTGW124AS <= 200.1.20 Improper Login Rate Limiting