What is the CVSS score of CVE-2026-27757?

CVE-2026-27757 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Sl902 Swtgw124as Firmware are affected by CVE-2026-27757?

A high-severity vulnerability in Sl902-Swtgw124As firmware allows unauthorized password changes without verification, potentially enabling account takeover of critical gateway devices.

How to fix or mitigate CVE-2026-27757?

Within 24 hours: Inventory all Sl902-Swtgw124As devices and identify those running firmware versions up to 200.1.20; restrict administrative access to affected devices to trusted networks only. Within 7 days: Implement enhanced monitoring for password change activities and failed authentication attempts on affected devices; document current admin account credentials and enforce multi-factor authentication where supported. Within 30 days: Contact vendor for patch availability and timeline; prepare change management plan for firmware updates once patches are released; consider replacing devices if vendor patch is unavailable within 60 days.

Sl902 Swtgw124as Firmware CVE-2026-27757

HIGH

Unverified Password Change (CWE-620)

2026-02-27 disclosure@vulncheck.com

Information Disclosure Sl902 Swtgw124as Firmware

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 19:16 nvd

HIGH 7.1

DescriptionCVE.org

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication vulnerability that allows authenticated users to change account passwords without verifying the current password. Attackers who gain access to an authenticated session can modify credentials to maintain persistent access to the management interface.

AnalysisAI

Sl902-Swtgw124As Firmware versions up to 200.1.20 contains a vulnerability that allows attackers to change account passwords without verifying the current password (CVSS 7.1).

Technical ContextAI

affects Sl902-Swtgw124As Firmware. SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication vulnerability that allows authenticated users to change account passwords without verifying the current password. Attackers who gain access to an authenticated session can modify credentials to maintain persistent access to the management interface.