CVE-2026-25070
Received Received - Intake
OS Command Injection in XikeStor SKS8310-8X Switch Enables Root RCE

Publication date: 2026-03-07

Last updated on: 2026-03-12

Assigner: VulnCheck

Description
XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain an OS command injection vulnerability in the /goform/PingTestSet endpoint that allows unauthenticated remote attackers to execute arbitrary operating system commands. Attackers can inject malicious commands through the destIp parameter to achieve remote code execution with root privileges on the network switch.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-07
Last Modified
2026-03-12
Generated
2026-06-16
AI Q&A
2026-03-07
EPSS Evaluated
2026-06-14
NVD
CVE-2026-25070
EUVD
EUVD-2026-10092
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
seekswan zikestor_sks8310-8x_firmware to 1.04.b07 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability exists in the firmware of the XikeStor SKS8310-8X Network Switch, specifically in versions 1.04.B07 and earlier. It is an OS command injection flaw found in the /goform/PingTestSet endpoint. This flaw allows unauthenticated remote attackers to inject malicious commands via the destIp parameter.

By exploiting this vulnerability, attackers can execute arbitrary operating system commands remotely with root privileges on the network switch.

Impact Analysis

This vulnerability can have severe impacts as it allows unauthenticated remote attackers to gain root-level access to the affected network switch.

  • Attackers can execute arbitrary commands on the device, potentially leading to full control over the network switch.
  • Compromise of the network switch could lead to interception, modification, or disruption of network traffic.
  • It may allow attackers to pivot into other parts of the network, escalating the scope of the attack.
  • The integrity and availability of network services relying on the switch could be severely affected.
Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25070. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart