Vulnerability · Published Feb 27, 2026 · Assigned by VulnCheck
CVE-2026-27756SODOLA SL902-SWTGW124AS <= 200.1.20 Reflected XSS in Management Interface
Medium 6.1
In plain English
A medium-severity cross-site scripting in SODOLA SL902-SWTGW124AS from Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a reflected cross-site scripting vulnerability in the management interface where user input is not properly encoded before output. Attackers can craft malicious URLs that execute arbitrary JavaScript in the web interface when visited by authenticated users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks) | SODOLA SL902-SWTGW124AS | 0 – through 200.1.20 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://www.sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch product
- https://www.vulncheck.com/advisories/sodola-sl902-swtgw124as-reflected-xss-in-management-interface third-party-advisory