What’s Vulnerable › Vulnerabilities

CVE-2026-25073: XikeStor SKS8310-8X Stored XSS via System Name

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-07 · updated 2026-06-17
• Weakness: CWE-79

Description

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary script content through the System Name field. Attackers can inject malicious scripts that execute in a victim's browser when the stored value is viewed due to improper output encoding.

Affected products

• Anhui Seeker Electronic Technology Co., LTD. XikeStor SKS8310-8X: through 1.04.b07

References

• https://openwrt.org/toh/xikestor/sks8310-8x?s%5B%5D=xikestor&s%5B%5D=sks8310&s%5B%5D=8x
• https://www.aliexpress.com/i/3256808697772710.html

Get alerted when CVE-2026-25073 or the next vulnerability affects your stack