Key points
- SODOLA SL902-SWTGW124AS firmware versions before 200.2.12 contain a high-severity buffer overflow.
- Attackers can trigger a denial of service by sending oversized Content-Type headers to the device.
- The vulnerability allows unauthenticated remote exploitation, causing the device to become fully unresponsive.
SODOLA SL902-SWTGW124AS devices running firmware versions prior to 200.2.12 are affected by a critical security flaw. A fix is available in firmware version 200.2.12. Administrators must update these gateways immediately to prevent remote attackers from crashing the system. This issue allows unauthorized users to disrupt network traffic and management access without needing login credentials.
In plain English
The vulnerability exists in the way the device handles web requests. Specifically, the embedded HTTP server struggles when it receives a POST request with a Content-Type header that is too large. This oversized input causes a buffer overflow, which is a type of memory error. As a result, the gateway crashes and stops working. The device may attempt to recover automatically, but during this time, it drops all management connections and stops forwarding network traffic.
The background
The National Vulnerability Database lists this issue as CVE-2026-0993. It carries a CVSS score of 8.7, which is rated as high severity. The weakness is classified under CWE-120, indicating a classic buffer overflow problem. The flaw affects the multipart/form-data boundary parser within the HTTP server. This component processes incoming data and fails to validate the size of certain headers properly.
What changes now
SODOLA has released firmware version 200.2.12 to address this specific buffer overflow. Users must upgrade to this version or later to mitigate the risk. Until the update is applied, the device remains vulnerable to remote denial-of-service attacks. No other patches or workarounds have been confirmed by the vendor. Organizations should verify their current firmware versions against this threshold.
Who needs to act first
Teams usually prioritize systems that face the internet or untrusted networks. Check whether your SODOLA gateways are exposed to external traffic. If they are, update them before internal-only devices. Test the new firmware in a non-production environment first to ensure stability. Back up current configurations before applying any changes. This reduces the risk of operational disruption during the upgrade process.
What to do and how to stay safe: SODOLA
- Verify the firmware version on all SODOLA SL902-SWTGW124AS devices in your network.
- Apply firmware version 200.2.12 or later as soon as possible.
- Monitor device logs for signs of unauthorized access or unusual POST requests.
- Restrict access to the management interface if immediate updating is not possible.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What exactly triggers this vulnerability?
Sending an oversized boundary value in the Content-Type header of a crafted POST request triggers the buffer overflow.
Do attackers need to log in to exploit this?
No, the vulnerability allows unauthenticated remote attackers to cause a denial of service without credentials.
Which SODOLA products are affected?
Only the SODOLA SL902-SWTGW124AS gateway is affected, specifically in firmware versions before 200.2.12.
