by Kastro
Paper/Archive/CVE-2026-25072

CVE-2026-25072

Anhui Seeker Electronic Technology Co., LTD. XikeStor SKS8310-8X — XikeStor SKS8310-8X Predictable Session Identifiers

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 43.9.439 × 208.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier vulnerability in the /goform/SetLogin endpoint that allows remote attackers to hijack authenticated sessions. Attackers can predict session identifiers using insufficiently random cookie values and exploit exposed session parameters in URLs to gain unauthorized access to authenticated user sessions.

Affected

ProductAffectedFixed inSource
XikeStor SKS8310-8X≤ 1.04.B07–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refaliexpress.com/i/3256808697772710.htmlrefopenwrt.org/toh/xikestor/sks8310-8x?s%5B%5D=xikestor&s%5B%5D=sks8310&s%5B%5D=8x