SODOLA SL902-SWTGW124AS MD5 Session Token Generation Vulnerability

A vulnerability exists in the SODOLA SL902-SWTGW124AS firmware versions through 200.1.20, where the outdated and cryptographically weak MD5 hash function is used to generate session cookies. This flaw compromises session security, allowing attackers to predict session tokens and exploit MD5's known collision vulnerabilities to create fake session cookies, potentially leading to unauthorized access to the device.

Impact

Exploitation of this vulnerability allows for session hijacking, where an attacker can forge valid session cookies and gain unauthorized access to the device.

Remediation

Users can upgrade to the latest firmware version, which is available on the SODOLA website. Instructions for upgrading the firmware are included in the SODOLA Managed Switch Web Manual.