CVE-2026-25073 MEDIUM

CVE-2026-25073: XikeStor SKS8310-8X Stored XSS via System Name

Vendor Anhui Seeker Electronic Technology Co., Ltd.
Product XikeStor SKS8310-8X
Weakness CWE-79 · XSS
Published March 7, 2026
Last update May 11, 2026

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary script content through the System Name field. Attackers can inject malicious scripts that execute in a victim's browser when the stored value is viewed due to improper output encoding.

Key dates

02Disclosure timeline

March 7, 2026 CVE published
May 11, 2026 Record updated