What is the CVSS score of CVE-2026-27751?

CVE-2026-27751 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Sl902 Swtgw124as Firmware are affected by CVE-2026-27751?

A critical vulnerability in Sl902-Swtgw124As firmware (versions up to 200.1.20) enables unauthenticated attackers to gain administrative access to the management interface, potentially compromising…

How to fix or mitigate CVE-2026-27751?

Within 24 hours: Identify and inventory all Sl902-Swtgw124As devices in production, determine firmware versions, and implement network segmentation to restrict management interface access. Within 7 days: Deploy compensating controls including access control lists (ACLs), firewall rules limiting administrative access to trusted IP ranges, and disable remote management if operationally feasible. Within 30 days: Monitor vendor advisories for patch availability, evaluate device replacement timelines if patches remain unavailable, and conduct forensic review of device logs for evidence of unauthorized access.

Sl902 Swtgw124as Firmware CVE-2026-27751

CRITICAL

Use of Default Credentials (CWE-1392)

2026-02-27 disclosure@vulncheck.com

Information Disclosure Sl902 Swtgw124as Firmware Sodola Network

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 18:16 nvd

CRITICAL 9.8

DescriptionCVE.org

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative access to the management interface. Attackers can authenticate using the hardcoded default credentials without password change enforcement to gain full administrative control of the device.

AnalysisAI

Default credentials in SODOLA SL902-SWTGW124AS network switch firmware allow unauthenticated remote access. Default credentials are publicly known, enabling complete device takeover.

Technical ContextAI

CWE-1392 default credentials in firmware through version 200.1.20. The switch ships with known default administrative credentials that users may not change.