CVE-2026-0993: SODOLA SL902-SWTGW124AS Buffer Overflow DoS via Multipart Boundary Parser
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle.
Affected Software
Event History
Frequently Asked Questions
Which devices are affected?
SODOLA SL902-SWTGW124AS devices running firmware earlier than 200.2.12 are affected.
Does exploitation require authentication or user interaction?
No. An unauthenticated remote attacker can trigger the issue without user interaction by sending a crafted POST request to the embedded HTTP server.
What is the operational impact of a successful attack?
The device can become fully unresponsive during its self-recovery cycle, dropping both management access and traffic forwarding.
What should be done to remediate the issue?
Update affected SL902-SWTGW124AS devices to firmware version 200.2.12 or later.