Reflected Cross-Site Scripting Vulnerability in SODOLA SL902-SWTGW124AS Firmware
CVE-2026-27756

5.1MEDIUM

Key Information:

Vendor

Shenzhen Hongyavision Technology Co., Ltd. (sodola Networks)

Status
Sodola Sl902-swtgw124as
Vendor
CVE Published:
27 February 2026

What is CVE-2026-27756?

The SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 are susceptible to a reflected cross-site scripting vulnerability within the management interface. This flaw allows attackers to craft malicious URLs that can execute arbitrary JavaScript in the web interface, especially when these URLs are accessed by authenticated users. Insecure handling of user inputs without proper encoding before output creates an opportunity for exploitation, elevating the risk of unauthorized access and data manipulation.

Affected Version(s)

SODOLA SL902-SWTGW124AS 0 <= 200.1.20

References

https://www.sodola-network.com/products/sodola-6-port-2-5...
product
https://www.vulncheck.com/advisories/sodola-sl902-swtgw12...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
.