PT-2026-22374 · Sodola · Sodola Sl902-Swtgw124As

Kazuma Matsumoto · Published 2026-02-27 · Updated 2026-03-03 · CVE-2026-27756

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SODOLA SL902-SWTGW124AS versions through 200.1.20

Description The software contains a reflected cross-site scripting issue in the management interface. User input is not properly encoded before being displayed, allowing attackers to execute arbitrary JavaScript code in the web interface when visited by authenticated users through crafted malicious URLs.

Recommendations Update to a version beyond 200.1.20.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27756

Affected Products

Sodola Sl902-Swtgw124As

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-27756 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27756 · Vendor Advisory
• https://twitter.com/CVEnew/status/2027466586366599575 · Twitter Post
• https://t.me/CVEtracker/45990 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2027474709273510313 · Twitter Post
• https://vulncheck.com/advisories/sodola-sl902-swtgw124as-reflected-xss-in-management-interface · Note
• https://t.me/cveNotify/154014 · Telegram Post
• https://sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch · Note