CVE Intelligence
Analysis AI-assisted

CVE-2026-25072: XikeStor SKS8310-8X Predictable Session Identifiers

XikeStor SKS8310-8X network switch firmware 1.04.B07 and earlier uses insufficiently random session identifiers, which can let a remote attacker predict and hijack authenticated sessions. NVD scores the issue 9.8 (critical) and VulnCheck scores it 8.6, and the record lists no fixed version. No confirmed exploitation appears in the sources consulted, and the issue is not listed in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The XikeStor SKS8310-8X is a network switch. According to the record, its firmware is affected up to and including 1.04.B07. The weakness is classified as CWE-330 (Use of Insufficiently Random Values) and concerns session identifiers handled by the /goform/SetLogin endpoint. Predictable cookie values and session parameters exposed in URLs could allow a remote party to take over an authenticated session.

Impact

  • NVD rates the confidentiality, integrity and availability impact as High, with a CVSS score of 9.8 (critical).
  • VulnCheck assigns a CVSS score of 8.6.
  • A successful hijack would give access to whatever the administrative session can change on the device, such as configuration and network settings.

Affected products and versions

  • Anhui Seeker Electronic Technology Co., LTD. XikeStor SKS8310-8X: versions 1.04.B07 and earlier.
  • Seekswan Zikestor Sks8310-8x Firmware: versions up to and including 1.04.b07.

Exploitation status

The issue is not listed in CISA KEV, so it is not reported as actively exploited in the wild. No confirmed exploitation appears in the sources consulted. SSVC data in the record marks exploitation as none and automatable as no. The EPSS probability is 0.00504 with a percentile of 0.42224.

Remediation and mitigation

  • The record lists no fixed version. This is unknown, not evidence that no fix exists. Check with the vendor or the device supplier for firmware newer than 1.04.B07.
  • Restrict access to the web management interface to trusted administrative networks and do not expose it to the internet.
  • Use strong, unique administrative credentials and limit the number of users with management access.
  • If no fixed firmware is available, plan to isolate or replace the device.

Detection guidance

  • Review management logs for logins from unexpected addresses or sessions that appear without a matching user action.
  • Watch for unusual numbers of concurrent administrative sessions or session activity outside maintenance windows.
  • Verify the firmware version on each device against the affected list above.

Limitations of the available information

  • The sources consulted are the NVD and CVE Program records; they do not include a vendor advisory or a fixed version.
  • Details about exploitability beyond the description are not in the record.
  • The EPSS date in the record is 2026-10-23, which should be verified against the current feed before relying on the score.
  • Reference links in the record point to product pages and do not confirm a patch.

Sources: NVD entry and CVE record.

Frequently asked questions

Is this vulnerability being actively exploited?

It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. Monitor official advisories for changes.

Is a fixed firmware version available?

The record lists no fixed version. This is unknown rather than proof that no fix exists, so check with the vendor for firmware newer than 1.04.B07.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.