CVE-2026-27757
SODOLA SL902-SWTGW124AS <= 200.1.20 Unverified Password Change
- State
- Published
- Severity
- 7.1 High
- Published
- Feb 27, 2026
- Updated
- Mar 2, 2026
- Reserved
- Feb 23, 2026
Description
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication vulnerability that allows authenticated users to change account passwords without verifying the current password. Attackers who gain access to an authenticated session can modify credentials to maintain persistent access to the management interface.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N | VulnCheck |
Weaknesses
- CWE-620 Unverified Password Change
Affected Products
| Product | Versions |
|---|---|
SODOLA SL902-SWTGW124ASShenzhen Hongyavision Technology Co., Ltd. (Sodola Networks) |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.