CVE-2026-27754: SODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token Generation
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 use the cryptographically broken MD5 hash function for session cookie generation, weakening session security. Attackers can exploit predictable session tokens combined with MD5's collision vulnerabilities to forge valid session cookies and gain unauthorized access to the device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27754?
CVE-2026-27754 is classified as a high severity vulnerability due to the use of the broken MD5 hash function for session token generation.
How do I fix CVE-2026-27754?
To fix CVE-2026-27754, upgrade the firmware of SODOLA SL902-SWTGW124AS to a version beyond 200.1.20 that implements a stronger hash function.
What are the potential consequences of exploiting CVE-2026-27754?
Exploiting CVE-2026-27754 could allow attackers to predict session tokens, leading to unauthorized access and session hijacking.
Which product versions are affected by CVE-2026-27754?
CVE-2026-27754 affects SODOLA SL902-SWTGW124AS firmware versions up to and including 200.1.20.
How does CVE-2026-27754 impact session security?
CVE-2026-27754 impacts session security by utilizing the insecure MD5 hash function, which can generate predictable session tokens.