CVE-2026-25073mediumCWE-79

CVE-2026-25073: medium-severity vulnerability in Anhui Seeker Electronic Technology Co., LTD.

XikeStor SKS8310-8X Stored XSS via System Name

Published · Updated

Follow this CVE+ Monitor XikeStor SKS8310-8X

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.2%
XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary script content through the System Name field. Attackers can inject malicious scripts that execute in a victim's browser when the stored value is viewed due to improper output encoding.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
Anhui Seeker Electronic Technology Co., LTD. · XikeStor SKS8310-8X
Related CVEs — Anhui Seeker Electronic Technology Co., LTD.

In the same product, most dangerous first.

CVE-2026-25070CRITICALXikeStor SKS8310-8X PingTestSet Command InjectionEPSS 3.3%CVE-2026-25071HIGHXikeStor SKS8310-8X switch_config.src Missing AuthenticationEPSS 0.6%CVE-2026-25072HIGHXikeStor SKS8310-8X Predictable Session IdentifiersEPSS 0.6%