The vulnerability in the SODOLA SL902‑SWTGW124AS firmware up to version 200.1.20 removes any login attempt throttling, enabling attackers to brute‑force passwords on the web‑based management interface. This improper rate limiting leaves the authentication mechanism open for repeated credential guessing, resulting in unauthorized device configuration changes, data exposure, or further network compromise. The flaw conforms to CWE‑307, which involves improper password or authentication mechanism usage.

The affected hardware is the SODOLA SL902‑SWTGW124AS switch manufactured by Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks). Firmware versions equal to or less than 200.1.20 are vulnerable; newer releases are not listed as impacted.

The vulnerability has a CVSS score of 6.9, indicating medium severity with a moderate impact on confidentiality and integrity. The EPSS score is listed as less than 1%, suggesting a very low probability of exploitation in the wild at present, and it is not included in CISA’s KEV catalog. Attackers would need remote access to the device’s management interface, most likely over the local network or an exposed management interface; the lack of lockout or rate limiting allows unlimited attempts with no prerequisites beyond network connectivity.