What is the CVSS score of CVE-2026-25071?

CVE-2026-25071 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Zikestor Sks8310 8x Firmware are affected by CVE-2026-25071?

XikeStor SKS8310-8X network switches in your infrastructure are vulnerable to unauthorized configuration file theft due to missing authentication controls.

How to fix or mitigate CVE-2026-25071?

Within 24 hours: Inventory all XikeStor SKS8310-8X switches and identify those running firmware 1.04.B07 or earlier; immediately restrict network access to the /switch_config.src endpoint via firewall rules to trusted management interfaces only. Within 7 days: Deploy compensating controls including network segmentation, WAF rules blocking unauthenticated config requests, and enhanced monitoring for suspicious access patterns to switch management interfaces. Within 30 days: Contact XikeStor for patch availability and develop a phased patching plan; consider replacement devices if no patch timeline is provided by vendor.

Zikestor Sks8310 8x Firmware CVE-2026-25071

HIGH

Missing Authentication for Critical Function (CWE-306)

2026-03-07 disclosure@vulncheck.com

Authentication Bypass Zikestor Sks8310 8x Firmware Seekswan

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 07, 2026 - 01:15 nvd

HIGH 7.5

DescriptionCVE.org

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a missing authentication vulnerability in the /switch_config.src endpoint that allows unauthenticated remote attackers to download device configuration files. Attackers can access this endpoint without credentials to retrieve sensitive configuration information including VLAN settings and IP addressing details.

AnalysisAI

Unauthenticated remote attackers can download sensitive configuration files from ZikeStor SKS8310-8X network switches (firmware 1.04.B07 and earlier) via an unprotected /switch_config.src endpoint, exposing VLAN settings and IP addressing details without requiring credentials. This HIGH severity vulnerability (CVSS 7.5) affects confidentiality of device configurations and currently has no available patch.

Technical ContextAI

Classified as CWE-306 (Missing Authentication for Critical Function). Affects Zikestor Sks8310-8X Firmware. XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a missing authentication vulnerability in the /switch_config.src endpoint that allows unauthenticated remote attackers to download device configuration files. Attackers can access this endpoint without credentials to retrieve sensitive configuration information including VLAN settings and IP addressing details.