SODOLA SL902-SWTGW124AS: Buffer overflow leading to denial of service via multipart boundary
Summary
The web management firmware of the SODOLA SL902-SWTGW124AS managed switch copies the multipart/form-data boundary value from the Content-Type header into a fixed-size buffer without a length check. An unauthenticated remote attacker who can reach the management interface can send one crafted POST request with a boundary of about 1440 bytes or more. The device then becomes unresponsive for roughly 11 to 13 seconds, dropping management access and traffic forwarding, and the attack can be repeated.
Affected
- SODOLA SL902-SWTGW124AS firmware before 200.2.12 (CVE text)
- Vendor-listed affected range per VulnCheck: 0 to 200.2.12 (conflicting, see notes)
- Firmware V200.2.4 is the latest build listed on the vendor firmware page and is affected
- Other OEM-derived switches on the same firmware branch: not confirmed
Fixed in
- Firmware V200.2.12 is reported as fixed by the researcher; the vendor has not been verified as confirming this
- Vendor fix status: Unknown.
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found.
- Proof of concept: the researcher describes a single-request reproduction; whether a public PoC is published is unconfirmed.
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: partial.
- EPSS: 0.00391 (low).
Our recommendation
- Check whether the management interface of the SL902-SWTGW124AS is reachable from untrusted networks and disable WAN access to it.
- Place switch management on a dedicated VLAN with restricted source addresses.
- Check the firmware version and update to V200.2.12 or later once confirmed by the vendor; do not interrupt the upgrade, which takes about five minutes.
- Monitor for unexpected switch reboots or loss of management access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Researcher blog (hml.io) hml.io
- VulDB CVE entry vuldb.com
- SODOLA firmware update page www.sodola-network.com
- Vulnrichment (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:41.
Original description (NVD)
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.