CVE-2026-25070
OS Command Injection in XikeStor SKS8310-8X Switch Enables Root RCE
Publication date: 2026-03-07
Last updated on: 2026-03-12
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| seekswan | zikestor_sks8310-8x_firmware | to 1.04.b07 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the firmware of the XikeStor SKS8310-8X Network Switch, specifically in versions 1.04.B07 and earlier. It is an OS command injection flaw found in the /goform/PingTestSet endpoint. This flaw allows unauthenticated remote attackers to inject malicious commands via the destIp parameter.
By exploiting this vulnerability, attackers can execute arbitrary operating system commands remotely with root privileges on the network switch.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows unauthenticated remote attackers to gain root-level access to the affected network switch.
- Attackers can execute arbitrary commands on the device, potentially leading to full control over the network switch.
- Compromise of the network switch could lead to interception, modification, or disruption of network traffic.
- It may allow attackers to pivot into other parts of the network, escalating the scope of the attack.
- The integrity and availability of network services relying on the switch could be severely affected.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know