CVE-2026-25071 describes a missing authentication vulnerability in the Anhui Seeker Electronic Technology Co., LTD. XikeStor SKS8310-8X network switch firmware versions 1.04.B07 and prior. The vulnerability exists in the /switch_config.src endpoint, which can be accessed remotely without credentials, allowing attackers to download device configuration files. These files contain sensitive network configuration details such as VLAN settings and IP addresses. The vulnerability is identified as CWE-306 and has a CVSS 4.0 base score of 8.7, indicating high severity. No patch or official fix is currently documented, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

An unauthenticated remote attacker can retrieve sensitive configuration information from the affected network switch, potentially exposing VLAN configurations and IP addressing details. This exposure could facilitate further network attacks or reconnaissance. There is no indication of direct code execution or denial of service from this vulnerability alone. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the management interface of the XikeStor SKS8310-8X device to trusted administrators only. Consider network segmentation or firewall rules to limit exposure of the /switch_config.src endpoint. Monitor vendor communications for updates on patches or official mitigations.