CVE-2026-27751: SODOLA SL902-SWTGW124AS Use of Default Credentials
SODOLA SL902-SWTGW124AS firmware through 200.1.20 contains built-in default credentials that allow remote administrative access to the management interface. The record describes no mandatory password change, which makes devices in their default state especially exposed. No fixed version is listed in the sources consulted.
Overview
The CVE record and the VulnCheck advisory describe a use of default credentials weakness in the SODOLA SL902-SWTGW124AS switch firmware, covering versions through 200.1.20. The weakness is classified as CWE-1392 and allows a remote attacker to sign in to the management interface with built-in default credentials.
Impact
- Administrative access to the management interface of affected devices.
- Because password change is not enforced, devices that remain in their default state can be taken over without any unique secret.
- The CNA assigned a CVSS base score of 9.8 with high confidentiality, integrity and availability impact, and the record describes the technical impact as total.
Affected products and versions
- Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks) SODOLA SL902-SWTGW124AS, versions through 200.1.20.
- Sodola-network SL902-SWTGW124AS firmware, versions through 200.1.20.
The record lists no fixed version. The absence of a fix in the record does not mean that none exists; whether a corrected firmware is available is unknown from the sources consulted.
Exploitation status
This CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00655 with a percentile of 0.50793, and the SSVC data marks exploitation as none and automatable as yes.
Remediation and mitigation
- Check the vendor channels for a firmware update that removes or replaces the default credentials. The record does not confirm that one exists.
- Replace default credentials on every affected unit where the device allows it, and use unique, strong passwords.
- Restrict access to the management interface to a dedicated administrative network or VLAN, and disable remote management exposed to untrusted networks.
- Inventory all SODOLA SL902-SWTGW124AS devices and compare their firmware against the affected range.
Detection guidance
- Review authentication logs for administrative logins from unexpected sources, at unusual times, or from accounts that should not exist.
- Monitor for configuration changes on the switch that were not made through approved change processes.
- Alert when management traffic reaches the switch from outside the approved administrative network.
Limitations of the available information
The record does not name the default account, does not describe the exact management interface affected, and lists no fixed version. Vendor advisories were not available in the sources consulted, so the availability of a patch remains unknown. The exposure of a given deployment depends on its configuration and network placement.
Frequently asked questions
What is the vulnerability in SODOLA SL902-SWTGW124AS?
The firmware through 200.1.20 contains built-in default credentials that allow remote administrative access to the management interface, and password change is not enforced.
Is a fixed version available?
The record lists no fixed version. Whether a corrected firmware exists is unknown from the sources consulted, so check the vendor channels.
Is this vulnerability being actively exploited?
This CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
What should administrators do now?
Replace default credentials where possible, restrict management access to a dedicated administrative network, and review logs for unexpected administrative logins.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.