CVE-2026-25071

XikeStor SKS8310-8X switch_config.src Missing Authentication

CVSS 8.7 HIGHEPSS 0.5%CWE-306

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.7EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

07 mar 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a missing authentication vulnerability in the /switch_config.src endpoint that allows unauthenticated remote attackers to download device configuration files. Attackers can access this endpoint without credentials to retrieve sensitive configuration information including VLAN settings and IP addressing details.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Produtos afetados

Anhui Seeker Electronic Technology Co., LTD. · XikeStor SKS8310-8X

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://openwrt.org/toh/xikestor/sks8310-8x?s%5B%5D=xikestor&s%5B%5D=sks8310&s%5B%5D=8x https://www.aliexpress.com/i/3256808697772710.html