CVE-2026-25070: XikeStor SKS8310-8X PingTestSet OS Command Injection
CVE-2026-25070 is an OS command injection flaw in the /goform/PingTestSet endpoint of XikeStor SKS8310-8X switch firmware up to and including 1.04.B07, as described in the record. The description states that an unauthenticated remote attacker can run arbitrary OS commands with root privileges. NVD scores it CVSS 3.1 9.8 (critical), and the record lists no fixed version.
Overview
CVE-2026-25070 is recorded as an OS command injection weakness (CWE-78) in the /goform/PingTestSet endpoint of XikeStor SKS8310-8X network switch firmware. The record describes firmware versions up to and including 1.04.B07. The source record is available in the NVD entry and the CVE.org record.
Impact
The record states that the flaw can be triggered without authentication and can lead to execution of arbitrary operating system commands with root privileges on the switch. A compromised switch could allow an attacker to change network behavior, intercept or redirect traffic, or use the device as a foothold inside the network. These consequences are inferred from the stated privilege level and are not described in the sources.
Affected products and versions
- Anhui Seeker Electronic Technology Co., LTD. XikeStor SKS8310-8X, up to and including 1.04.B07.
- Seekswan Zikestor Sks8310-8x Firmware, up to and including 1.04.B07.
The lowercase variant 1.04.b07 is also listed in the record for the second product entry.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so no active exploitation is confirmed here. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.03052 with a percentile of 0.87488, as recorded, and the SSVC exploitation field is recorded as none. These values describe predicted likelihood, not observed attacks.
Remediation and mitigation
The record lists no fixed version. This does not mean no fix exists. Operators should check the vendor or distributor for firmware updates for the SKS8310-8X and apply any update that addresses this issue. Until a fix is confirmed, consider restricting access to the switch management interface to trusted administrative networks, placing it behind segmentation or a management VLAN, and disabling remote web management where the device allows it.
Detection guidance
- Review web management logs for requests to the /goform/PingTestSet path from unexpected sources.
- Look for unexplained configuration changes, new accounts, or unusual outbound connections originating from the switch.
- Monitor for unexpected restarts or changes in firmware version.
- Treat any unrecognized management access as a potential incident and verify the device state.
Limitations of the available information
The record does not include a vendor advisory, a fixed firmware version, a proof-of-concept reference, or details on how the flaw is exploited. The CVSS 4.0 scores from VulnCheck are listed as 9.3 in the record, while NVD provides CVSS 3.1 9.8. Whether the device is exposed on the internet, and whether the management interface is enabled by default, is unknown from the record.
Frequently asked questions
What is CVE-2026-25070?
It is an OS command injection vulnerability in the /goform/PingTestSet endpoint of XikeStor SKS8310-8X switch firmware, according to the record.
Is there a fix available?
The record lists no fixed version. This does not mean no fix exists, so check the vendor or distributor for firmware updates.
Is this CVE known to be actively exploited?
No. The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.