CVE-2026-25070

🗓️ 07 Mar 2026 00:20:03Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 9 Views🌐 WEB

CVE two thousand twenty six two fifty seventy: XikeStor PingTestSet destination IP injection enables unauthenticated root remote code execution.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-25070	7 Mar 202600:20	–	attackerkb
Circl	CVE-2026-25070	7 Mar 202601:30	–	circl
CNNVD	XikeStor SKS8310-8X 操作系统命令注入漏洞	7 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-25070 XikeStor SKS8310-8X PingTestSet Command Injection	7 Mar 202600:20	–	cvelist
EUVD	EUVD-2026-10092	7 Mar 202603:30	–	euvd
NVD	CVE-2026-25070	7 Mar 202601:15	–	nvd
Positive Technologies	PT-2026-23781	7 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-25070	8 Mar 202601:44	–	redhatcve
Vulnrichment	CVE-2026-25070 XikeStor SKS8310-8X PingTestSet Command Injection	7 Mar 202600:20	–	vulnrichment

NVD

Vulners

Node

seekswan zikestor_sks8310-8x_firmwareRange≤1.04.b07

AND

seekswan zikestor_sks8310-8xMatch-

[
  {
    "defaultStatus": "unknown",
    "product": "XikeStor SKS8310-8X",
    "vendor": "Anhui Seeker Electronic Technology Co., LTD.",
    "versions": [
      {
        "lessThanOrEqual": "1.04.B07",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
openwrt	www.openwrt.org/toh/xikestor/sks8310-8x
aliexpress	www.aliexpress.com/i/3256808697772710.html

Parameter	Position	Path	Description	CWE
destIp	request body	/goform/PingTestSet	OS command injection via destIp parameter in /goform/PingTestSet allowing unauthenticated remote attackers to execute arbitrary OS commands with root privileges.	CWE-78

17 Jun 2026 10:24Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.19.8

CVSS 49.3

EPSS0.02999

SSVC

CWE-78