CVE-2026-27756CWE-79

SODOLA SL902-SWTGW124AS <= 200.1.20 Reflected XSS in Management Interface

Medium · published February 27, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
19.7
In the wild
Unconfirmed
What it is

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a reflected cross-site scripting vulnerability in the management interface where user input is not properly encoded before output. Attackers can craft malicious URLs that execute arbitrary JavaScript in the web interface when visited by authenticated users.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00282 · 19.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-27T18:10Z
EPSS history
Timeline
  • 27 FEB 18:10Z
    SODOLA SL902-SWTGW124AS <= 200.1.20 Reflected XSS in Management Interface
    cvelistv5