SODOLA SL902‑SWTGW124AS firmware versions through 200.1.20 use a weak session identifier that can be computed by attackers who know or guess valid user credentials, allowing them to forge the MD5‑based cookie and skip the normal login process. The result is unrestricted access to the device’s configuration interface, giving attackers full control over the switch, potentially compromising confidentiality, integrity, and availability of the connected network. This weakness maps to CWE‑330, the use of weak cryptographic keys.

Shenzhen Hongyavision Technology Co., Ltd., doing business as Sodola Networks, exposes the SODOLA SL902‑SWTGW124AS managed switch. Firmware versions 200.1.20 and earlier are affected; newer releases may contain a fix.

The vulnerability has a CVSS score of 9.3 and an EPSS score of less than 1 percent, indicating a very low but non‑zero probability of exploitation at the time of analysis. It is not currently listed in the U.S. CISA KEV catalog. The attack vector is most likely remote, as the device’s web interface can be accessed over the network. Attackers must first obtain or guess valid credentials, then compute the predictable session identifier offline. Once the forged cookie is supplied, the authentication step is bypassed and the attacker gains full administrative privileges. Given the device’s role in data center or enterprise environments, compromise can lead to widespread disruption or data exfiltration if the switch is part of critical infrastructure.