SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a reflected cross-site scripting vulnerability in the management interface where user input is not properly encoded before output. Attackers can craft malicious URLs that execute arbitrary JavaScript in the web interface when visited by authenticated users.
References
Configurations
Configuration 1 (hide)
| AND |
|
History
03 Mar 2026, 19:12
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch - Product | |
| References | () https://www.vulncheck.com/advisories/sodola-sl902-swtgw124as-reflected-xss-in-management-interface - Third Party Advisory | |
| First Time |
Sodola-network
Sodola-network sl902-swtgw124as Sodola-network sl902-swtgw124as Firmware |
|
| CPE | cpe:2.3:h:sodola-network:sl902-swtgw124as:-:*:*:*:*:*:*:* cpe:2.3:o:sodola-network:sl902-swtgw124as_firmware:*:*:*:*:*:*:*:* |
27 Feb 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-27 19:16
Updated : 2026-03-03 19:12
NVD link : CVE-2026-27756
Mitre link : CVE-2026-27756
CVE.ORG link : CVE-2026-27756
JSON object : View
Products Affected
sodola-network
- sl902-swtgw124as_firmware
- sl902-swtgw124as
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')