TI-2026-22118 Aliases CVE-2026-27758 GHSA-9m8f-2x73-hmhp

SODOLA SL902-SWTGW124AS <= 200.1.20 Missing CSRF Protections

LOW 22CWE-352Published 2026-02-27 · Updated 2026-03-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Tampering
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a cross-site request forgery vulnerability in its management interface that allows attackers to induce authenticated users into submitting forged requests. Attackers can craft malicious requests that execute unauthorized configuration or administrative actions with the victim's privileges when the authenticated user visits a malicious webpage.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00121 1st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks)	SODOLA SL902-SWTGW124AS	up to 200.1.20	—	No fix listed	CNA

SODOLA SL902-SWTGW124AS VendorShenzhen Hongyavision Technology Co., Ltd. (Sodola Networks) Affected up to 200.1.20 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:sodola-network:sl902-swtgw124as_firmware::::::::	up to 200.1.20	Vulnerable	Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks)
cpe:2.3:h:sodola-network:sl902-swtgw124as:-:::::::*	not specified by NVD	Running on	Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks)

cpe:2.3:o:sodola-network:sl902-swtgw124as_firmware:*:*:*:*:*:*:*:* Versions up to 200.1.20 Vulnerable ·Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks)
cpe:2.3:h:sodola-network:sl902-swtgw124as:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks)

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-27758
2026-10-03 Alias added: GHSA-9m8f-2x73-hmhp

References

Other 1

https://www.sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch

TI-2026-22111 SODOLA SL902-SWTGW124AS <= 200.1.20 Use of Default Credentials CVSS 4.0CRITICAL 9.3
TI-2026-22115 SODOLA SL902-SWTGW124AS <= 200.1.20 Predictable Session ID CVSS 4.0CRITICAL 9.3
TI-2026-22113 SODOLA SL902-SWTGW124AS <= 200.1.20 Improper Login Rate Limiting CVSS 4.0MEDIUM 6.9
TI-2026-22114 SODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token Generation CVSS 4.0MEDIUM 6.9
TI-2026-22112 SODOLA SL902-SWTGW124AS <= 200.1.20 Cleartext Credential Transmission CVSS 4.0HIGH 8.2
TI-2026-22117 SODOLA SL902-SWTGW124AS <= 200.1.20 Unverified Password Change CVSS 4.0HIGH 7.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences