CVE-2026-0993 in SL902-SWTGW124AS
Summary
by MITRE • 10/15/2026
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The SODOLA SL902-SWTGW124AS network switch, specifically firmware versions prior to 200.2.12, contains a critical buffer overflow vulnerability within its embedded HTTP server implementation. This flaw is located in the parser responsible for handling multipart/form-data requests, which are commonly used when uploading configuration files or managing device settings through web-based interfaces. The specific technical failure occurs during the processing of the Content-Type header, where an oversized boundary value provided by a remote attacker triggers an out-of-bounds write operation. This memory corruption allows unauthenticated users to exploit the vulnerability without needing valid credentials, as the HTTP server typically listens on standard management ports accessible from external networks or internal subnets depending on device configuration.
From a technical perspective, this vulnerability represents a classic heap-based buffer overflow where input validation is insufficiently rigorous regarding length constraints. When an attacker crafts a POST request with a Content-Type header containing a boundary string that exceeds the allocated memory buffer size, the parser fails to truncate or properly handle the excess data. This results in adjacent memory being overwritten, which corrupts critical control structures within the application stack. The immediate operational consequence is a crash of the HTTP service process on the device. Because this switch relies heavily on its embedded web server for management and potentially for certain forwarding plane operations depending on the firmware architecture, the crash leads to a complete loss of functionality.
The impact of this denial-of-service condition extends beyond simple service unavailability. The vulnerability causes the entire device to become fully unresponsive, effectively halting all traffic forwarding capabilities alongside dropping all management access via SSH, Telnet, or web interfaces. This state persists until the device undergoes its self-recovery cycle, which may involve a reboot sequence that can take several minutes depending on hardware initialization times. During this downtime, network connectivity is severed for any devices relying on this switch as an uplink or distribution point, leading to significant operational disruption in production environments. The lack of authentication required to trigger the exploit makes it particularly dangerous against internet-facing management interfaces or poorly segmented internal networks where lateral movement could facilitate further attacks if other services are compromised during the recovery phase.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-120, Buffer Copy without Checking Size of Input, and CWE-400, Uncontrolled Resource Consumption, which describes how the resource exhaustion leads to denial of service. In terms of offensive security frameworks, this exploit technique corresponds to MITRE ATT&CK tactic T1499, Endpoint Denial of Service, specifically under subtechniques involving application crashes or memory corruption attacks like heap spraying or buffer overflows (T1499.002). The ability to crash a network infrastructure device remotely without authentication places this vulnerability in the highest severity category for availability impact.
Mitigation strategies primarily involve applying the vendor-provided firmware update version 200.2.12 or later, which addresses the input validation logic within the multipart/form-data parser. Until patches are applied, administrators should restrict access to the device's management interfaces using strict firewall rules that limit source IP addresses to trusted administrative subnets only. Additionally, disabling unnecessary HTTP services if they are not required for daily operations can reduce the attack surface. Network segmentation is also recommended to ensure that even if an attacker gains initial foothold elsewhere in the network, they cannot directly reach the vulnerable management ports of this switch. Regular vulnerability scanning and monitoring for anomalous traffic patterns targeting web server endpoints on port 80 or 443 can help detect attempted exploitation activities before a successful crash occurs.