CVE-2026-25070 in XikeStor SKS8310-8X
Summary
by MITRE • 03/07/2026
XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain an OS command injection vulnerability in the /goform/PingTestSet endpoint that allows unauthenticated remote attackers to execute arbitrary operating system commands. Attackers can inject malicious commands through the destIp parameter to achieve remote code execution with root privileges on the network switch.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 03/12/2026
The vulnerability identified as CVE-2026-25070 affects the XikeStor SKS8310-8X network switch firmware versions 1.04.B07 and earlier, representing a critical security flaw that exposes network infrastructure to remote exploitation. This issue resides within the web-based management interface of the device, specifically in the /goform/PingTestSet endpoint which handles network diagnostic functionality. The flaw enables unauthenticated remote attackers to inject operating system commands directly into the device's underlying operating system, bypassing normal authentication mechanisms and gaining full administrative control over the affected switch.
The technical implementation of this vulnerability stems from inadequate input validation and sanitization within the destIp parameter of the PingTestSet endpoint. When the device processes incoming requests containing malicious command injection payloads, it fails to properly escape or filter special characters that could be interpreted as operating system commands. This represents a classic os command injection vulnerability classified under CWE-77, where user-supplied data is directly incorporated into system command execution without proper sanitization. The vulnerability allows attackers to leverage standard network diagnostic functionality to achieve arbitrary code execution, transforming legitimate network testing capabilities into a weapon for system compromise.
The operational impact of this vulnerability is severe and far-reaching for network administrators and security professionals. Remote code execution with root privileges enables attackers to completely compromise the network switch, potentially gaining access to sensitive network traffic, modifying network configurations, or using the device as a pivot point for further attacks within the network infrastructure. The unauthenticated nature of the exploit means that any remote attacker can leverage this vulnerability without requiring valid credentials, making it particularly dangerous in environments where network switches are exposed to untrusted networks. This vulnerability directly maps to attack techniques described in the MITRE ATT&CK framework under T1059.001 for command and scripting interpreter and T1021.001 for remote services, as it enables both command execution and remote access capabilities.
Network switches represent critical infrastructure components that often operate with elevated privileges and have direct access to network traffic flows, making them attractive targets for attackers seeking persistent access or network-wide compromise. The affected XikeStor SKS8310-8X devices likely operate in environments where they are directly accessible from external networks or where network segmentation is insufficient to protect management interfaces. Security teams should consider this vulnerability as a potential entry point for attackers seeking to establish persistent access to network infrastructure, particularly in scenarios where switches are configured with default credentials or lack proper network access controls. The vulnerability's impact extends beyond immediate device compromise to potentially affect entire network segments that rely on the compromised switch for connectivity and traffic management.
Mitigation strategies for this vulnerability should include immediate firmware updates from XikeStor to address the command injection flaw, along with network segmentation to restrict access to management interfaces. Organizations should implement strict access controls to limit who can reach the switch management endpoints, particularly by blocking external access to the /goform/PingTestSet endpoint. Network administrators should also deploy intrusion detection systems capable of identifying command injection attempts and monitor for unusual patterns in network diagnostic traffic. Additional protective measures include disabling unnecessary network services, implementing network access control lists to restrict management interface access, and conducting comprehensive network assessments to identify other potentially vulnerable devices. Regular security audits and vulnerability assessments should be performed to ensure that all network infrastructure components are running patched firmware versions and that proper security configurations are maintained to prevent similar vulnerabilities from being exploited in the future.