CVE-2026-27755
Published: 27 February 2026
Summary
CVE-2026-27755 is a critical-severity Use of Insufficiently Random Values (CWE-330) vulnerability in Sodola-Network Sl902-Swtgw124As Firmware. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SC-23 (Session Authenticity).
Deeper analysis
CVE-2026-27755, published on 2026-02-27, is a weak session identifier generation vulnerability (CWE-330) affecting SODOLA SL902-SWTGW124AS firmware versions through 200.1.20. The device generates predictable MD5-based cookies for session identifiers, enabling attackers to forge authenticated sessions. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with high impacts on confidentiality, integrity, and availability.
Remote attackers can exploit this vulnerability if they know or guess valid credentials. By computing the predictable session identifier offline, they bypass the normal login flow, forge an authenticated session, and gain unauthorized access to the device without requiring privileges, user interaction, or elevated complexity.
Advisories and mitigation details are referenced in the VulnCheck advisory at https://www.vulncheck.com/advisories/sodola-sl902-swtgw124as-predictable-session-id and the vendor product page at https://www.sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9045
Vulnerability details
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing predictable MD5-based cookies. Attackers who know or guess valid credentials can calculate the session identifier offline and bypass…
more
authentication without completing the login flow, gaining unauthorized access to the device.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability in the web management interface of the network switch enables exploitation of a public-facing application (T1190) via predictable session identifiers, directly facilitating the forging of web session cookies for unauthorized access (T1606.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires protection of communications session authenticity to prevent forgery via predictable session identifiers.
Mandates secure generation and management of authenticators, including session cookies, to avoid predictable MD5-based identifiers that enable offline computation and forgery.
Requires timely identification, reporting, and correction of flaws such as weak session identifier generation in device firmware.