CVE-2026-27753 is an authentication bypass vulnerability in Shenzhen Hongyavision Technology Co., Ltd.'s SODOLA SL902-SWTGW124AS device firmware versions through 200.1.20. The flaw allows remote attackers to conduct unlimited login attempts against the management interface without triggering account lockout or rate limiting mechanisms. This enables online password guessing attacks that could lead to unauthorized access to the device's management functions. The vulnerability is categorized under CWE-307, indicating improper restriction of excessive authentication attempts. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality and integrity, with limited impact on availability.

The vulnerability allows remote attackers to perform unlimited authentication attempts on the device management interface, increasing the risk of successful brute force or password guessing attacks. Unauthorized access to the management interface could lead to control over device configuration and operation. However, the impact is rated medium severity with limited confidentiality and integrity impact and no availability impact as per the CVSS 4.0 vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been documented, organizations should monitor for vendor updates. Until a patch is available, consider restricting network access to the management interface to trusted hosts only and implementing compensating controls such as network-level rate limiting or VPN access to reduce exposure.