Login Request a demo
Medium severity · published Feb 27, 2026
CVE-2026-27756
SODOLA SL902-SWTGW124AS <= 200.1.20 Reflected XSS in Management Interface
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a reflected cross-site scripting vulnerability in the management interface where user input is not properly encoded before output. Attackers can craft malicious URLs that execute arbitrary JavaScript in the web interface when visited by authenticated users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
SODOLA SL902-SWTGW124AS · Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks)
through 200.1.20 · source: vendor
SF
Sl902-swtgw124as Firmware · Sodola-network
through 200.1.20 · source: NVD
Affected product
SS
SODOLA SL902-SWTGW124AS
Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27756
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27756
Product
https://www.sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch
Third Party Advisory
https://www.vulncheck.com/advisories/sodola-sl902-swtgw124as-reflected-xss-in-management-interface
More from SODOLA SL902-SWTGW124AS
9.8
CVE-2026-27755
SODOLA SL902-SWTGW124AS <= 200.1.20 Predictable Session ID
9.8
CVE-2026-27751
SODOLA SL902-SWTGW124AS <= 200.1.20 Use of Default Credentials
7.2
CVE-2026-27757
SODOLA SL902-SWTGW124AS <= 200.1.20 Unverified Password Change
6.5
CVE-2026-27758
SODOLA SL902-SWTGW124AS <= 200.1.20 Missing CSRF Protections
6.5
CVE-2026-27754
SODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token Generation