How to Fix CVE-2026-27758: SODOLA SL902-SWTGW124AS (Bundle Sibling)

By Sai Kiran Pandrala. Last verified: 2026-05-25.

CVE-2026-27758 is a sibling vulnerability in the same vendor advisory as CVE-2026-27751. Apply the same patched build and you close both. The technical detail below is what differs.

What's different about CVE-2026-27758?

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a cross-site request forgery vulnerability in its management interface that allows attackers to induce authenticated users into submitting forged requests. Attackers can craft malicious requests that execute unauthorized configuration or administrative actions with the victim's privileges when the authenticated user visits a malicious webpage.

How to fix CVE-2026-27758

Apply the patched build per the primary write-up: How to Fix CVE-2026-27751. All commands, verification steps, and rollback notes for SODOLA SL902-SWTGW124AS are listed there.

Frequently asked questions

Does the CVE-2026-27751 patch close CVE-2026-27758?

Yes. Both CVEs are addressed by the same vendor patch. Applying the patched build closes the full bundle.

Is CVE-2026-27758 listed in CISA KEV?

No public KEV listing at the time of this writing.

Where is the official advisory?

See https://www.sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch

References

• Official vendor advisory: https://www.sodola-network.com/products/sodola-6-port-2-5g-easy-web-managed-switch-4-x-2-5g-base-t-ports-2-x-10g-sfp-static-aggregation-qos-vlan-igmp-2-5gb-network-home-lab-switch
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-27758
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Primary: How to Fix CVE-2026-27751

*Written by Sai Kiran Pandrala. Part of the SODOLA SL902-SWTGW124AS bundle. Full procedure at how-to-fix-cve-2026-27751.*