PT-2026-22376 · Sodola · Sodola Sl902-Swtgw124As

Kazuma Matsumoto · Published 2026-02-27 · Updated 2026-03-03 · CVE-2026-27758

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SODOLA SL902-SWTGW124AS versions through 200.1.20

Description The firmware contains a cross-site request forgery flaw in its management interface. This allows attackers to trick authenticated users into performing unintended actions. An attacker can create malicious requests that execute unauthorized configuration or administrative actions with the victim’s permissions when the user visits a compromised webpage.

Recommendations Update to a version later than 200.1.20.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-27758

Affected Products

Sodola Sl902-Swtgw124As

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-27758 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27758 · Vendor Advisory
• https://sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch · Note
• https://t.me/CVEtracker/45992 · Telegram Post
• https://vulncheck.com/advisories/sodola-sl902-swtgw124as-missing-csrf-protections · Note
• https://twitter.com/CVEnew/status/2027466584592421156 · Twitter Post
• https://t.me/cveNotify/154016 · Telegram Post