CVE-2026-27758 MEDIUM

CVE-2026-27758: SODOLA SL902-SWTGW124AS <= 200.1.20 Missing CSRF Protections

Vendor Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks)
Product SODOLA SL902-SWTGW124AS
Weakness CWE-352 · CSRF
Published February 27, 2026
Last update March 2, 2026

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a cross-site request forgery vulnerability in its management interface that allows attackers to induce authenticated users into submitting forged requests. Attackers can craft malicious requests that execute unauthorized configuration or administrative actions with the victim's privileges when the authenticated user visits a malicious webpage.

Key dates

02Disclosure timeline

February 27, 2026 CVE published
March 2, 2026 Record updated