Home / Vulnerability Intelligence / CVE-2026-27755

CVE-2026-27755 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: February 27, 2026

SODOLA SL902-SWTGW124AS - Authentication Bypass

Published: February 27, 2026Updated: February 27, 2026Remote Exploitable

Overview

SODOLA SL902-SWTGW124AS firmware <= 200.1.20 contains a broken authentication caused by weak MD5-based session identifier generation, letting attackers with valid credentials bypass authentication and gain unauthorized access.

Severity & Score

Severity: Critical

CVSS Score: 9.8

Impact

Attackers can bypass authentication and gain unauthorized access to the device.

Mitigation

Update to the latest firmware version beyond 200.1.20.

References

https://www.sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch
https://www.vulncheck.com/advisories/sodola-sl902-swtgw124as-predictable-session-id

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-27755
Severity: Critical
CVSS Score: 9.8
Type: broken_authentication
Status: new

CWE

CWE-330

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H