Shenzhen Hongyavision Technology SODOLA SL902-SWTGW124AS up to 200.1.20 Network Traffic cleartext transmission

Summaryinfo

A vulnerability identified as problematic has been detected in Shenzhen Hongyavision Technology SODOLA SL902-SWTGW124AS up to 200.1.20. This impacts an unknown function of the component Network Traffic Handler. The manipulation leads to cleartext transmission. This vulnerability is listed as CVE-2026-27752. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Shenzhen Hongyavision Technology SODOLA SL902-SWTGW124AS up to 200.1.20. This issue affects some unknown functionality of the component Network Traffic Handler. The manipulation with an unknown input leads to a cleartext transmission vulnerability. Using CWE to declare the problem leads to CWE-319. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. Impacted is confidentiality. The summary by CVE is:

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 transmit authentication credentials over unencrypted HTTP, allowing attackers to capture credentials. An attacker positioned to observe network traffic between a user and the device can intercept credentials and reuse them to gain administrative access to the gateway.

The weakness was presented by Kazuma Matsumoto. It is possible to read the advisory at sodola-network.com. The identification of this vulnerability is CVE-2026-27752 since 02/23/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1040 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-9041). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Shenzhen Hongyavision Technology

Name

• SODOLA SL902-SWTGW124AS

Version

• 200.1.0
• 200.1.1
• 200.1.2
• 200.1.3
• 200.1.4
• 200.1.5
• 200.1.6
• 200.1.7
• 200.1.8
• 200.1.9
• 200.1.10
• 200.1.11
• 200.1.12
• 200.1.13
• 200.1.14
• 200.1.15
• 200.1.16
• 200.1.17
• 200.1.18
• 200.1.19
• 200.1.20

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion