The vulnerability resides in the firmware version V300SP10260209 and earlier of Binardat's 10G08‑0800GSM network switch. The device uses RC4 encryption with a hard‑coded key embedded in client‑side JavaScript. Because the key is static and exposed in the source code, an attacker who can access the management web interface or obtain the firmware image can retrieve the key and decrypt any values protected by RC4, thereby breaking confidentiality protections.

The affected hardware is Binardat Ltd.'s 10G08‑0800GSM switch, which serves 8‑port 10‑gigabit SFP‑managed networking with L3 web management. Any unit running firmware V300SP10260209 or earlier is impacted. No other product versions were identified as vulnerable.

The CVSS base score of 8.7 reflects a high severity due to the potential for confidentiality loss without authentication, but the EPSS is less than 1%, indicating that exploitation is currently unlikely. The vulnerability is not listed in KEV, suggesting no widely known exploitation. An attacker could glean the key by downloading the page containing the JavaScript or by reverse‑engineering the firmware. The static nature of the key means the flaw remains even after multiple firmware releases until the key is removed or encryption hardened.