Login Request a demo
High severity · published Feb 27, 2026
CVE-2026-27757
SODOLA SL902-SWTGW124AS <= 200.1.20 Unverified Password Change
7.2
CVSS
0.3%
EPSS
No
On KEV
Description
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication vulnerability that allows authenticated users to change account passwords without verifying the current password. Attackers who gain access to an authenticated session can modify credentials to maintain persistent access to the management interface.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
SODOLA SL902-SWTGW124AS · Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks)
through 200.1.20 · source: vendor
SF
Sl902-swtgw124as Firmware · Sodola-network
through 200.1.20 · source: NVD
Affected product
SS
SODOLA SL902-SWTGW124AS
Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27757
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27757
Product
https://www.sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch
Third Party Advisory
https://www.vulncheck.com/advisories/sodola-sl902-swtgw124as-unverified-password-change
More from SODOLA SL902-SWTGW124AS
9.8
CVE-2026-27755
SODOLA SL902-SWTGW124AS <= 200.1.20 Predictable Session ID
9.8
CVE-2026-27751
SODOLA SL902-SWTGW124AS <= 200.1.20 Use of Default Credentials
6.5
CVE-2026-27758
SODOLA SL902-SWTGW124AS <= 200.1.20 Missing CSRF Protections
6.5
CVE-2026-27754
SODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token Generation
6.5
CVE-2026-27753
SODOLA SL902-SWTGW124AS <= 200.1.20 Improper Login Rate Limiting