A cross‑site request forgery flaw exists in the management interface of the SODOLA SL902‑SWTGW124AS switch firmware until version 200.1.20. The vulnerability allows an attacker to trick an authenticated user into submitting web requests that perform configuration or administrative actions. The impact is that any action the authenticated user can perform may be carried out by the attacker, potentially compromising network control and policy settings.

The affected device is the SODOLA SL902‑SWTGW124AS switch from Shenzhen Hongyavision Technology. Firmware versions up to and including 200.1.20 are vulnerable. No other vendors or product lines are listed as impacted.

The CVSS score of 5.1 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to lure a legitimate, authenticated user to a malicious web page to trigger the forged request. The exploit requires the victim to be logged into the switch’s web interface and to have sufficient privileges to invoke the targeted configuration functions. No additional prerequisites such as local access are necessary.