CVE-2026-0993 Details
Description
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle.
A buffer overflow vulnerability has been identified in the Sodola SL902-SWTGW124AS managed switch, specifically in firmware versions prior to 200.2.12. This vulnerability allows unauthenticated remote attackers to cause a denial-of-service condition by sending a crafted POST request with an oversized boundary value in the Content-Type header. The embedded HTTP server's multipart/form-data boundary parser is exploited, causing the device to become unresponsive and drop all management access and traffic forwarding. The switch self-recovers after approximately 11 to 13 seconds.
Users can upgrade to Sodola SL902-SWTGW124AS firmware version 200.2.12, which fixes the vulnerability. As of the publication date, this version is not available on the vendor's public download page, so users should contact Sodola support directly to request it.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hml.io/posts/blog-post-cve-2026-0993/ | [email protected] | ExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/sodola-sl902-swtgw124as-buffer-overflow-dos-via-multipart-boundary-parser | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sodola SL902-SWTGW124AS | < 200.2.12 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |