CVE-2026-0993

{
  "etk_id": "ETK-2026-1631",
  "cve_id": "CVE-2026-0993",
  "display_id": "CVE-2026-0993",
  "ghsa_id": "GHSA-mqpm-mf8q-5w3f",
  "euvd_id": "EUVD-2026-101803",
  "status": "published",
  "anchor_state": "anchored",
  "title": "HTTP multipart parser buffer overflow in SODOLA SL902-SWTGW124AS",
  "summary": "SODOLA SL902-SWTGW124AS firmware before 200.2.12 is affected by a buffer overflow in its embedded HTTP server's multipart form-data parsing. An unauthenticated remote attacker can cause the device to become unresponsive, interrupting management access and traffic forwarding. Exposure requires the device's HTTP service to be reachable by the attacker.",
  "mitigation": "Upgrade SL902-SWTGW124AS firmware to version 200.2.12 or later. Until upgraded, restrict access to the device's HTTP management service to trusted administrative networks.",
  "vendor": "SODOLA",
  "product": "SL902-SWTGW124AS",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 200.2.12"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "SL902-SWTGW124AS",
      "purl": null
    }
  ],
  "cwes": [
    120
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0039,
  "epss_percentile": 0.3179,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 33.620435066666666,
  "t0_at": "2026-10-15T00:40:42.822000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-15T00:40:42.822000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T00:40:42.822000+00:00",
      "url": "https://hml.io/posts/blog-post-cve-2026-0993/"
    },
    "trigger_signal": {
      "at": "2026-10-15T00:40:42.822000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T00:40:42.822000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-0993"
    }
  }
}