CVE-2026-25070

🗓️ 07 Mar 2026 00:20:03Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 43 Views🌐 WEB

CVE two thousand twenty six two fifty seventy: XikeStor PingTestSet destination IP injection enables unauthenticated root remote code execution.

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2026-25070	7 Mar 202600:20	–	attackerkb
Circl	CVE-2026-25070	7 Mar 202601:30	–	circl
CNNVD	XikeStor SKS8310-8X: Operating System Command Injection Vulnerability	7 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-25070 XikeStor SKS8310-8X PingTestSet Command Injection	7 Mar 202600:20	–	cvelist
EUVD	EUVD-2026-10092	7 Mar 202603:30	–	euvd
NVD	CVE-2026-25070	7 Mar 202601:15	–	nvd
osv_cve	CVE-2026-25070	7 Mar 202601:15	–	osv_cve
Positive Technologies	PT-2026-23781	7 Mar 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-25070: Improper Neutralization of Special Elements used in an OS Command	7 Mar 202600:00	–	rapid7
RedhatCVE	CVE-2026-25070	8 Mar 202601:44	–	redhatcve

NVD

Vulners

Node

AND

seekswan zikestor_sks8310-8x_firmwareRange≤1.04.b07

seekswan zikestor_sks8310-8xMatch-

[
  {
    "defaultStatus": "unknown",
    "product": "XikeStor SKS8310-8X",
    "vendor": "Anhui Seeker Electronic Technology Co., LTD.",
    "versions": [
      {
        "lessThanOrEqual": "1.04.B07",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
openwrt	www.openwrt.org/toh/xikestor/sks8310-8x
aliexpress	www.aliexpress.com/i/3256808697772710.html

Parameter	Position	Path	Description	CWE
destIp	query param	/goform/PingTestSet	OS command injection vulnerability in the /goform/PingTestSet endpoint via the destIp parameter, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges.	CWE-78

17 Jun 2026 10:24Current

7High risk

Vulners AI Score7

CVSS 3.19.8

CVSS 49.3

EPSS0.03052

SSVC

CWE-78