SODOLA SL902-SWTGW124AS CVE-2026-0993

Exploitation requires network access to the device's embedded HTTP management server and the ability to send a crafted multipart/form-data POST request with an oversized boundary value in the Content-Type header; no authentication is required (PR:N) and no user interaction is needed. The only meaningful limiting factor is reachability of the management interface - if the switch's web management plane is segmented onto an isolated management VLAN or otherwise not exposed to attacker-controlled networks, the attack surface is sharply reduced. Impact is limited to availability: the device self-recovers after the DoS cycle, with no code execution, data disclosure, or configuration tampering.

Signals are internally consistent and point to a moderate-to-high operational risk that is confined to availability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a low-complexity, remote, unauthenticated attack requiring no user interaction, and the impact is availability-only (VA:H) with no confidentiality or integrity effect (VC:N/VI:N) - matching the description of a denial-of-service that drops management access and traffic forwarding. Publicly available exploit code (via the referenced blog and VulnCheck advisory) raises the practical likelihood of opportunistic use, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation at this time. The practical priority is therefore driven down by two factors not captured in the raw 8.7 score: the impact is a self-recovering DoS rather than code execution or data loss, and the affected product (a SODOLA managed switch) has a narrow deployment footprint. Net assessment: patch promptly where these switches sit in the management/forwarding path, but this is not a mass-exploitation, high-value target comparable to a ubiquitous server product. Missing data to note: no EPSS and no KEV status supplied, so exploitation-in-the-wild cannot be confirmed or ruled out from the input alone.

A remote attacker with network reach to the switch's embedded HTTP management interface sends a crafted multipart/form-data POST request containing an oversized boundary value in the Content-Type header, overflowing the boundary parser. The device becomes fully unresponsive, dropping all management access and traffic forwarding until it completes a self-recovery cycle. Public exploit code exists (referenced proof-of-concept blog post and VulnCheck advisory), lowering the skill barrier for repeatable disruption.