Missing Authentication Vulnerability in XikeStor SKS8310-8X Network Switch
CVE-2026-25071

8.7HIGH

Key Information:

Vendor

Anhui Seeker Electronic Technology Co., Ltd.

Status
Xikestor Sks8310-8x
Vendor
CVE Published:
7 March 2026

What is CVE-2026-25071?

A vulnerability in the XikeStor SKS8310-8X Network Switch allows attackers to leverage a flaw in the firmware versions 1.04.B07 and earlier. Specifically, the issue lies within the /switch_config.src endpoint, which fails to properly authenticate users. This oversight enables unauthorized individuals to access sensitive device configuration files, potentially exposing critical details such as VLAN settings and IP address configurations. It is essential for users to review their device settings and update to the latest firmware version to mitigate the risk of exploitation.

Affected Version(s)

XikeStor SKS8310-8X 0 <= 1.04.B07

References

https://www.aliexpress.com/i/3256808697772710.html
product
https://openwrt.org/toh/xikestor/sks8310-8x?s%5B%5D=xikes...
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
VulnCheck
.