An authenticated password change vulnerability in the Sodola SL902-SWTGW124AS switch allows attackers to hijack administrative accounts and maintain persistent unauthorized access.

This vulnerability, categorized as CWE-620, permits any authenticated user to change the password of any account, including administrative accounts, without verifying the existing password. The flaw resides within the management interface and requires an active, authenticated session to trigger.

Successful exploitation of this flaw can lead to a total compromise of the network switch management interface. By resetting account credentials, an attacker can gain persistent, unauthorized administrative access, potentially leading to unauthorized network traffic interception, configuration changes, or complete device takeover, justifying the 7.1 CVSS score.

Immediate Action: Contact Sodola Networks support to obtain the latest firmware update that addresses this vulnerability, as a specific patch version is not currently listed in public records.

Proactive Monitoring: Monitor management interface access logs for unusual login patterns or frequent password change requests originating from non-administrative user accounts.

Compensating Controls: Restrict access to the switch management interface to trusted IP addresses only using access control lists, and ensure that management traffic is segmented from general user traffic.

Public Exploit Available: Unknown

Given the potential for unauthorized persistence within critical network infrastructure, administrators should prioritize securing the management interface of the affected switches. Until a firmware patch is confirmed and applied, limit administrative access to the device to mitigate the risk of exploitation by malicious actors.