CVE-2026-27755
Received Received - Intake

Predictable Session ID Vulnerability in SODOLA SL902-SWTGW124AS Firmware

Publication date: 2026-02-27

Last updated on: 2026-03-03

Assigner: VulnCheck

Description
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing predictable MD5-based cookies. Attackers who know or guess valid credentials can calculate the session identifier offline and bypass authentication without completing the login flow, gaining unauthorized access to the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-27
Last Modified
2026-03-03
Generated
2026-07-06
AI Q&A
2026-02-27
EPSS Evaluated
2026-07-05
NVD
CVE-2026-27755
EUVD
EUVD-2026-9045

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sodola-network sl902-swtgw124as_firmware to 200.1.20 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability exists in SODOLA SL902-SWTGW124AS firmware versions through 200.1.20, where the session identifier generation is weak. Specifically, it uses predictable MD5-based cookies for session identifiers.

This weakness allows attackers who know or can guess valid credentials to compute the session identifier offline without needing to complete the login process.

As a result, attackers can forge authenticated sessions and bypass authentication, gaining unauthorized access to the device.

Impact Analysis

This vulnerability can have serious impacts as it allows attackers to bypass authentication and gain unauthorized access to the affected device.

Once inside, attackers could potentially control or manipulate the device, access sensitive information, or disrupt normal operations.

Given the high CVSS scores (9.3 in v4.0 and 9.8 in v3.1), the vulnerability is considered critical and poses a significant security risk.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27755. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart