A flaw in the firmware of the SODOLA SL902-SWTGW124AS device causes session cookies to be generated with the MD5 hash function, which is cryptographically broken. Attackers can predict or forge session tokens that appear legitimate, allowing them to hijack sessions and gain unauthorized administrator access to the switch. The weakness aligns with CWE-328, a weakness in cryptographic hash usage.

The vulnerability affects Sudola Networks SODOLA SL902-SWTGW124AS switches running firmware version 200.1.20 or earlier. No later versions are known to be impacted. Systems in production that rely on web‑based management are subject to the risk.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score of less than 1 % suggests a low probability of exploitation. The device is not listed in the CISA KEV catalog, further indicating limited known exploitation. The likely attack vector is remote, accessed via the switch’s web management interface, where an attacker can send crafted session tokens to fool the authentication mechanism. An attacker does not need any privileged local access to create a session; the flaw allows direct hijacking of an existing session or creation of a new one that the device will accept.