EUVD-2026-80224
GHSA-jxpm-cmg2-h9hw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach switch management interface
-
DeliverySend unauthenticated configuration download request
-
ExploitReceive plaintext config file
-
ExecutionExtract embedded credentials and network topology
-
PersistAuthenticate to switch or adjacent network devices
-
ImpactPivot into internal network segments
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication or special privilege is required. The only prerequisite is network reachability to the switch management interface - typically TCP port 80 or 443 on the management IP. If the management interface is bound to a dedicated management VLAN or restricted by ACLs, those controls limit exposure. Default deployments with no management-plane segregation on firmware below V1.04.B09 are exploitable with a single unauthenticated request. There is no required user interaction and no non-default configuration needed to trigger the vulnerability. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) correctly captures the core risk: zero-friction remote exploitation with high confidentiality impact. There are no attack complexity or prerequisite barriers - any attacker who can reach the switch management interface can trigger this. The direct CVSS impact shows no integrity or availability impact, but this understates real-world risk: extracted credentials enable authenticated follow-on actions (reconfiguration, lateral movement) that constitute integrity impact through a second step. EPSS data was not provided in the input. No public exploit code and no CISA KEV listing are noted, meaning active widespread exploitation is not confirmed. Given the network-equipment context and the credential-disclosure nature, this is a genuine operational priority for any organization running these specific models - particularly if management interfaces are reachable beyond the local LAN. |
| Exploit ScenarioDerived | An attacker with network access to the switch management interface - whether via the internet if the interface is publicly exposed, or from an adjacent network segment - sends a single unauthenticated HTTP request to the configuration download endpoint. The switch returns a full configuration file containing management credentials, SNMP strings, and network topology. The attacker uses recovered credentials to log into the switch and reconfigure routing or ACLs, or uses the switch as a trusted jump host to access other internal systems. No public exploit code is referenced, but the simplicity of the technique (a direct unauthenticated HTTP request) means weaponization requires minimal skill. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Unauthenticated remote access to the configuration download function on XikeStor Layer3 switches (SKS8300-8T, SKS8300-12E2T2X, SKS8310-8X) running firmware below V1.04.B09 exposes full device configuration files to any network-reachable attacker. Recovered configurations contain network topology details and credentials, enabling attackers to authenticate to the switch itself or leverage it as a pivot point into the protected network segment it manages. Disclosed by JPCERT/CC (JVN#45281119); no public exploit code or active exploitation (CISA KEV) identified at time of analysis.
Earlier versions of this analysis (1)
Missing authentication on a network-accessible configuration download endpoint in XikeStor Layer3 switches (SKS8300-8T, SKS8310-8X, SKS8300-12E2T2X, all versions prior to V1.04.B09) allows any unauthenticated remote attacker to retrieve the full device configuration file. That file contains network topology data and credentials (passwords), enabling follow-on attacks including credential reuse against the switch management interface or other network devices, or exploitation of the switch as a pivot point into the protected network segment. No public exploit or KEV listing has been identified at time of analysis; JPCERT coordinated disclosure through JVN#45281119.
RemediationAI
Upgrade affected switches to firmware V1.04.B09 or later, as confirmed by the vendor advisory at https://www.xikestor.com/security-advisory/ and JPCERT/CC publication JVN#45281119. As an immediate compensating control before patching, restrict access to the switch management interface using firewall ACLs or out-of-band management VLANs so only authorized management hosts can reach the device - this reduces the attack surface without disabling any device function. Additionally, rotate all credentials stored in switch configurations (management accounts, SNMP community strings, RADIUS shared secrets) on affected devices, since any previous configuration download cannot be ruled out on unpatched deployments. Placing management interfaces on a dedicated, isolated VLAN with jump-host access control is a durable hardening step regardless of patch status.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
XikeStor SKS-series Layer3 managed switches (CPE: cpe:2.3:a:xikestor:sks8310-8x, sks8300-8t, sks8300-12e2t2x) expose a network-accessible configuration download endpoint that performs no authentication before serving device configuration data. CWE-306 (Missing Authentication for Critical Function) describes this root cause: a management-plane function that should require operator credentials is callable without any identity verification. Layer3 switches store configurations containing VLANs, routing tables, SNMP community strings, and management account credentials - making the configuration file a high-value target for an adversary seeking to understand or compromise the network.
Know when Sks8310 8X gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable, zero prerequisites, unauthenticated; impact is confidentiality only - no direct integrity or availability loss from the disclosure step itself.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
3DescriptionCVE.org
XikeStor Layer3 switches miss authentication for downloading configuration data. Unauthenticated attacker may retrieve the configuration data containing network configurations and passwords to operate the affected product improperly or to exploit the affected product as a jump host.
Executive ViewAI
XikeStor Layer3 switches (SKS8300 series) with firmware below V1.04.B09 expose complete device configurations-including network topology and administrative credentials-to any network-reachable attacker without authentication. This vulnerability allows attackers to compromise the switches themselves or pivot laterally into protected network segments, creating direct risk to network infrastructure integrity and data access controls.
No vendor-released patch identified at time of analysis. Implement network segmentation to isolate affected switches from less-trusted segments; restrict configuration access to hardened administrative workstations only via VPN; enable detailed audit logging of all configuration access attempts with real-time alerting on downloads from unexpected sources; maintain offline encrypted backups of current device configurations to detect unauthorized modifications; implement read-only access controls on configuration interfaces where possible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB