XikeStor SKS8310-8X Network Switch Missing Authentication Vulnerability Allowing Unauthenticated Configuration File Downloads

A missing authentication vulnerability has been identified in the XikeStor SKS8310-8X network switch, affecting firmware versions through 1.04.B07. The vulnerability exists in the '/switch_config.src' endpoint, where unauthenticated remote attackers can download sensitive device configuration files. This includes critical information such as VLAN settings and IP addressing details.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive configuration information, which could be used to manipulate network settings or disrupt service.