CVE-2026-0993: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in SODOLA SL902-SWTGW124AS

The SODOLA SL902-SWTGW124AS firmware before version 200.2.12 contains a classic buffer overflow vulnerability due to lack of input size validation on the multipart/form-data boundary value in the Content-Type header. An unauthenticated remote attacker can send a specially crafted POST request with an oversized boundary value, triggering the embedded HTTP server's multipart parser to overflow a buffer. This causes the device to become unresponsive, dropping all management access and interrupting traffic forwarding until the device recovers.

Successful exploitation results in denial of service by making the device fully unresponsive. This disrupts management access and halts traffic forwarding during the device's self-recovery cycle, potentially impacting network availability and device operability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the device's management interface from untrusted networks to reduce exposure.