CVE-2026-25071

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25071
XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a missing authentication vulnerability in the /switch_config.src endpoint that allows unauthenticated remote attackers to download device configuration files. Attackers can access this endpoint without credentials to retrieve sensitive configuration information including VLAN settings and IP addressing details.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://openwrt.org/toh/xikestor/sks8310-8x?s%5B%5D=xikestor&s%5B%5D=sks8310&s%5B%5D=8x Product
https://www.aliexpress.com/i/3256808697772710.html Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:seekswan:zikestor_sks8310-8x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:seekswan:zikestor_sks8310-8x:-:*:*:*:*:*:*:*
History

12 Mar 2026, 15:00

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
First Time Seekswan
Seekswan zikestor Sks8310-8x Firmware
Seekswan zikestor Sks8310-8x
References () https://openwrt.org/toh/xikestor/sks8310-8x?s%5B%5D=xikestor&s%5B%5D=sks8310&s%5B%5D=8x - () https://openwrt.org/toh/xikestor/sks8310-8x?s%5B%5D=xikestor&s%5B%5D=sks8310&s%5B%5D=8x - Product
References () https://www.aliexpress.com/i/3256808697772710.html - () https://www.aliexpress.com/i/3256808697772710.html - Product
CPE cpe:2.3:h:seekswan:zikestor_sks8310-8x:-:*:*:*:*:*:*:*
cpe:2.3:o:seekswan:zikestor_sks8310-8x_firmware:*:*:*:*:*:*:*:*
Summary
  • (es) Las versiones de firmware 1.04.B07 y anteriores del switch de red XikeStor SKS8310-8X contienen una vulnerabilidad de autenticación faltante en el endpoint /switch_config.src que permite a atacantes remotos no autenticados descargar archivos de configuración del dispositivo. Los atacantes pueden acceder a este endpoint sin credenciales para recuperar información de configuración sensible, incluyendo la configuración de VLAN y detalles de direccionamiento IP.

07 Mar 2026, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-07 01:15

Updated : 2026-03-12 15:00

NVD link : CVE-2026-25071

Mitre link : CVE-2026-25071

CVE.ORG link : CVE-2026-25071

JSON object : View

Products Affected

seekswan

  • zikestor_sks8310-8x_firmware
  • zikestor_sks8310-8x
CWE
CWE-306

Missing Authentication for Critical Function