PT-2026-22372 · Sodola · Sodola Sl902-Swtgw124As

Kazuma Matsumoto · Published 2026-02-27 · Updated 2026-03-03 · CVE-2026-27754

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SODOLA SL902-SWTGW124AS firmware versions through 200.1.20

Description The firmware utilizes the MD5 hash function for session cookie generation, which weakens session security. This is due to the predictability of session tokens and MD5’s collision vulnerabilities, potentially allowing attackers to forge valid session cookies and gain unauthorized access to the device.

Recommendations Update to a firmware version newer than 200.1.20.

Fix

Weakness Enumeration

CWE-328

Related Identifiers

CVE-2026-27754

Affected Products

Sodola Sl902-Swtgw124As

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-27754 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27754 · Vendor Advisory
• https://t.me/CVEtracker/45988 · Telegram Post
• https://sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch · Note
• https://vulncheck.com/advisories/sodola-sl902-swtgw124as-md5-session-token-generation · Note
• https://t.me/cveNotify/154012 · Telegram Post
• https://twitter.com/CVEnew/status/2027466588128219609 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027482388016632109 · Twitter Post