Unencrypted Credential Transmission in SODOLA SL902-SWTGW124AS Firmware
CVE-2026-27752

8.2HIGH

Key Information:

Vendor

Shenzhen Hongyavision Technology Co., Ltd. (sodola Networks)

Status
Sodola Sl902-swtgw124as
Vendor
CVE Published:
27 February 2026

What is CVE-2026-27752?

The SODOLA SL902-SWTGW124AS gateway’s firmware versions up to 200.1.20 transmit authentication credentials over unencrypted HTTP, exposing them to potential interception by malicious actors. This vulnerability enables attackers in the network vicinity to capture sensitive credentials and exploit them, potentially leading to unauthorized administrative access to the device. Users should be aware of the risks associated with unencrypted data transmission and consider updating their firmware to mitigate these issues.

Affected Version(s)

SODOLA SL902-SWTGW124AS 0 <= 200.1.20

References

https://www.sodola-network.com/products/sodola-6-port-2-5...
product
https://www.vulncheck.com/advisories/sodola-sl902-swtgw12...
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
.