Predictable Session Identifier Vulnerability in XikeStor SKS8310-8X Network Switch
CVE-2026-25072

8.6HIGH

Key Information:

Vendor

Anhui Seeker Electronic Technology Co., Ltd.

Status
Xikestor Sks8310-8x
Vendor
CVE Published:
7 March 2026

What is CVE-2026-25072?

The XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and earlier have a vulnerability in the /goform/SetLogin endpoint that allows attackers to exploit predictable session identifiers. Due to insufficient randomness in cookie values, compromised session identifiers can lead to unauthorized access to authenticated user sessions. This vulnerability highlights the importance of implementing robust session management practices to safeguard against potential attacks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

XikeStor SKS8310-8X 0 <= 1.04.B07

References

https://www.aliexpress.com/i/3256808697772710.html
product
https://openwrt.org/toh/xikestor/sks8310-8x?s%5B%5D=xikes...
product

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
VulnCheck
JSON
.