CVE-2026-25071 | THREATINT

Description

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a missing authentication vulnerability in the /switch_config.src endpoint that allows unauthenticated remote attackers to download device configuration files. Attackers can access this endpoint without credentials to retrieve sensitive configuration information including VLAN settings and IP addressing details.

PUBLISHED Reserved 2026-01-28 | Published 2026-03-07 | Updated 2026-03-07 | Assigner VulnCheck

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-306 Missing Authentication for Critical Function

Product status

Default status

unknown

Any version

affected

Credits

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc. finder

VulnCheck coordinator

References

www.aliexpress.com/i/3256808697772710.html product

openwrt.org/...x?s%5B%5D=xikestor&s%5B%5D=sks8310&s%5B%5D=8x product

cve.org (CVE-2026-25071)

nvd.nist.gov (CVE-2026-25071)

Download JSON