CVE-2026-27757CWE-620

SODOLA SL902-SWTGW124AS <= 200.1.20 Unverified Password Change

High · published February 27, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication vulnerability that allows authenticated users to change account passwords without verifying the current password. Attackers who gain access to an authenticated session can modify credentials to maintain persistent access to the management interface.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00484 · 40.7th percentile
Weakness
CWE-620 · Unverified Password Change
Published
2026-02-27T18:11Z
EPSS history
Timeline
  • 27 FEB 18:11Z
    SODOLA SL902-SWTGW124AS <= 200.1.20 Unverified Password Change
    cvelistv5