Session Identifier Vulnerability in SODOLA SL902-SWTGW124AS Firmware
CVE-2026-27755

9.3CRITICAL

Key Information:

Vendor

Shenzhen Hongyavision Technology Co., Ltd. (sodola Networks)

Status
Sodola Sl902-swtgw124as
Vendor
CVE Published:
27 February 2026

What is CVE-2026-27755?

The SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 are prone to a session identifier vulnerability that allows for the generation of predictable session identifiers. Attackers can exploit this flaw by calculating MD5-based cookies, enabling them to forge authenticated sessions. If they know or can guess valid user credentials, they can bypass the authentication process entirely and gain unauthorized access to the device. This vulnerability underscores the importance of implementing stronger session management practices to protect against potential intrusions.

Affected Version(s)

SODOLA SL902-SWTGW124AS 0 <= 200.1.20

References

https://www.sodola-network.com/products/sodola-6-port-2-5...
product
https://www.vulncheck.com/advisories/sodola-sl902-swtgw12...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
.