CVE-2026-27758: CSRF in SODOLA SL902-SWTGW124AS Firmware

The CSRF vulnerability in SODOLA SL902-SWTGW124AS firmware allows an attacker to leverage a user's authenticated session to perform actions as that user. This could include modifying device settings, disabling security features, or even gaining full administrative control. An attacker could host a malicious webpage that, when visited by an authenticated user, silently sends crafted requests to the device's management interface. The blast radius extends to any user with access to the management interface, and successful exploitation could compromise the entire device and potentially the network it's connected to. While no direct precedent exists for this specific device, CSRF vulnerabilities are commonly exploited to gain unauthorized access and control.

1. Reserved2026-02-23
2. Published2026-02-27
3. Modified2026-03-02
4. EPSS updated2026-03-23

Due to the lack of a provided fixed version, mitigation strategies focus on reducing the attack surface and preventing exploitation. Restricting access to the management interface to trusted networks or using VPNs is crucial. Implementing strict input validation on all requests to the management interface can help prevent malicious data from being processed. Consider using a Web Application Firewall (WAF) to filter out potentially malicious requests. Monitor device logs for suspicious activity, particularly unexpected configuration changes. After a firmware upgrade is released, verify the fix by attempting to trigger a CSRF request and confirming it is blocked or fails.