⚠ Reference material — not professional advice. Test in staging, back up first, verify against your specific version. Use your own judgment for your environment.
● Medium · CVSS 6.9

How to Fix CVE-2026-27753: SODOLA SL902-SWTGW124AS (Bundle Sibling)

By Sai Kiran Pandrala. Last verified: 2026-05-25.

CVE-2026-27753 is a sibling vulnerability in the same vendor advisory as CVE-2026-27751. Apply the same patched build and you close both. The technical detail below is what differs.

⚡ At a glance
Severity6.9 (Medium)
Actively exploited?No public listing in CISA KEV
AffectedSODOLA SL902-SWTGW124AS 0 to <=200.1.20
Fixed inSame patched build as CVE-2026-27751
Type (CWE)CWE-307 Improper Restriction of Excessive Authentication Attempts

What's different about CVE-2026-27753?

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication bypass vulnerability that allows remote attackers to perform unlimited login attempts against the management interface. Attackers can conduct online password guessing attacks without account lockout or rate limiting restrictions to gain unauthorized access to the device management interface.

How to fix CVE-2026-27753

Apply the patched build per the primary write-up: How to Fix CVE-2026-27751. All commands, verification steps, and rollback notes for SODOLA SL902-SWTGW124AS are listed there.

Frequently asked questions

Does the CVE-2026-27751 patch close CVE-2026-27753?

Yes. Both CVEs are addressed by the same vendor patch. Applying the patched build closes the full bundle.

Is CVE-2026-27753 listed in CISA KEV?

No public KEV listing at the time of this writing.

Where is the official advisory?

See https://www.sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch

References

*Written by Sai Kiran Pandrala. Part of the SODOLA SL902-SWTGW124AS bundle. Full procedure at how-to-fix-cve-2026-27751.*