PT-2026-22373 · Sodola · Sodola Sl902-Swtgw124As

Kazuma Matsumoto · Publicado 2026-02-27 · Atualizado 2026-03-04 · CVE-2026-27755

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SODOLA SL902-SWTGW124AS firmware versions through 200.1.20

Description The firmware contains a weakness in how session identifiers are created. This allows attackers to create valid session identifiers without logging in, potentially gaining unauthorized access to the device. The session identifiers are generated using a predictable MD5-based method, enabling attackers to forge authenticated sessions.

Recommendations Firmware versions prior to 200.1.20 should be updated.

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

Identificadores relacionados

CVE-2026-27755

Produtos afetados

Sodola Sl902-Swtgw124As

Referências · 10

• https://twitter.com/cracbot/status/2029150054553206923 · Publicação no Twitter
• https://t.me/cveNotify/154013 · Publicação no Telegram
• https://t.me/CVEtracker/45989 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-27755 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-27755 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2027466587239027123 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2027469109370229060 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2027462844175024572 · Publicação no Twitter
• https://sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch · Nota
• https://vulncheck.com/advisories/sodola-sl902-swtgw124as-predictable-session-id · Nota