CVE-2026-27752
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedSODOLA SL902-SWTGW124AS firmware versions through 200.1.20 transmit authentication credentials over unencrypted HTTP, allowing attackers to capture credentials. An attacker positioned to observe network traffic between a user and the device can intercept credentials and reuse them to gain administrative access to the gateway.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe SODOLA SL902-SWTGW124AS gateway firmware through version 200.1.20 transmits user authentication credentials in cleartext over unencrypted HTTP. An attacker positioned on the network path between the user and device can intercept these credentials using packet capture or man-in-the-middle techniques and subsequently reuse them to obtain administrative access to the gateway.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data<= 200.1.20CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- High
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify the installed firmware versionAccess the device administrative interface or check the device status page to view the firmware version number. Compare this version against the affected range: version 200.1.20 or lower.Affected if The firmware version is 200.1.20 or any version lower than 200.1.20.
-
Determine if HTTP is enabled for administrative accessAttempt to access the device admin panel by entering the gateway IP address in a web browser using the HTTP protocol (http://<device_ip>). Observe whether the login page loads over HTTP.Affected if The administrative interface is accessible over HTTP (not just HTTPS).
-
Verify if HTTPS is NOT configured for admin accessCheck whether the device supports and has TLS/SSL enabled for its administrative interface. Attempt to access the admin panel using HTTPS (https://<device_ip>) and note whether a valid secure connection is established.Affected if HTTPS is either unavailable or not configured for the administrative interface, forcing cleartext HTTP access.
-
Confirm credentials are transmitted in cleartextUse a network sniffer or browser developer tools to capture network traffic during a login attempt to the device admin panel. Inspect the HTTP POST request to see if the username and password are sent as plain, unencrypted text.Affected if Login credentials are visible in plain text within the HTTP request body.
Your environment is affected if the device runs firmware version 200.1.20 or lower AND the administrative interface is accessible over HTTP without TLS encryption, allowing credentials to be transmitted in cleartext.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataEnable HTTPS on the device if the firmware supports TLS/SSL for administrative interfaces; if not supported, implement network segmentation and/or VPN tunneling to protect HTTP traffic between users and the gateway.
- Consultation3.0 h
- Implementation5.0 h
- Testing2.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,456.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-27752 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-27752 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data