CVE-2026-27754CWE-328

SODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token Generation

Medium · published February 27, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
9.0
In the wild
Unconfirmed
What it is

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 use the cryptographically broken MD5 hash function for session cookie generation, weakening session security. Attackers can exploit predictable session tokens combined with MD5's collision vulnerabilities to forge valid session cookies and gain unauthorized access to the device.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00197 · 9.0th percentile
Weakness
CWE-328 · Use of Weak Hash
Published
2026-02-27T18:09Z
EPSS history
Timeline
  • 27 FEB 18:09Z
    SODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token Generation
    cvelistv5