A missing authentication flaw in the /switch_config.src endpoint permits an attacker to retrieve the entire device configuration without requiring any credentials. The exposed information contains VLAN assignments and IP addressing data that can enable further network reconnaissance and targeted attacks. This vulnerability is a direct authentication bypass (CWE‑306) and allows disclosure of confidential configuration information, potentially leading to privilege escalation or lateral movement in the network.

Anhui Seeker Electronic Technology Co., LTD. XikeStor SKS8310‑8X network switches running firmware version 1.04.B07 or older are affected. The flaw resides in the embedded switch firmware and applies to devices of the SKS8310‑8X model line.

The CVSS score of 8.7 denotes high severity, yet the EPSS score is below 1 %, indicating a low predicted exploitation likelihood at the present time. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are documented. The attack vector is inferred to be remote, as network traffic can be directed at the switch’s /switch_config.src endpoint without authentication, assuming the device is reachable on the internal or external network.