PT-2026-23781 · Xikestor · Xikestor Sks8310-8X Network Switch

Vulncheck · Published 2026-03-07 · Updated 2026-03-12 · CVE-2026-25070

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XikeStor SKS8310-8X Network Switch versions prior to 1.04.B07

Description The XikeStor SKS8310-8X Network Switch contains an OS command injection issue in the /goform/PingTestSet API endpoint. Unauthenticated remote attackers can execute arbitrary operating system commands with root privileges on the network switch. Attackers can inject malicious commands through the destIp parameter to achieve remote code execution. This allows for potential use as a pivot point for lateral movement within a network.

Recommendations Versions prior to 1.04.B07 should be updated.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-25070

Affected Products

Xikestor Sks8310-8X Network Switch

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-25070 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25070 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2030340515225391484 · Twitter Post
• https://twitter.com/0dayPublishing/status/2030288645219815925 · Twitter Post
• https://twitter.com/vuldb/status/2030194387070996709 · Twitter Post
• https://twitter.com/CVEnew/status/2030339375138234535 · Twitter Post
• https://openwrt.org/toh/xikestor/sks8310-8x?s%5B%5D=xikestor&s%5B%5D=sks8310&s%5B%5D=8x · Note
• https://t.me/CVEtracker/46670 · Telegram Post
• https://t.me/cveNotify/154554 · Telegram Post
• https://aliexpress.com/i/3256808697772710.html · Note
• https://t.me/cveNotify/155298 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2030163165552529757 · Twitter Post