CVE-2026-25070: XikeStor SKS8310-8X Firmware RCE Flaw

CVE-2026-25070 Overview

CVE-2026-25070 is an unauthenticated operating system command injection vulnerability affecting XikeStor SKS8310-8X network switches running firmware version 1.04.B07 and earlier. The flaw resides in the /goform/PingTestSet endpoint, where the destIp parameter is passed to a system shell without proper sanitization. Remote attackers can inject arbitrary shell commands and gain code execution with root privileges on the switch. The weakness is classified under CWE-78, Improper Neutralization of Special Elements Used in an OS Command.

Critical Impact
Unauthenticated remote attackers can execute arbitrary OS commands as root on affected network switches through the destIp parameter of the ping diagnostic endpoint.

Affected Products

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior
XikeStor SKS8310-8X hardware appliance
Devices exposing the web management interface on the network

Discovery Timeline

2026-03-07 - CVE-2026-25070 published to the National Vulnerability Database (NVD)
2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-25070

Vulnerability Analysis

The SKS8310-8X switch exposes a web-based management interface that includes a ping diagnostic feature. The /goform/PingTestSet handler accepts a user-supplied destIp parameter intended to specify the target IP address for an ICMP echo request. Instead of validating the parameter as an IP address or passing it as an argument to execve, the firmware concatenates the value directly into a shell command string before execution.

This design enables classic OS command injection. An attacker who can reach the management interface over the network can append shell metacharacters such as ;, |, or backticks to the destIp value. The injected payload runs in the same process context as the web server, which operates as root on this embedded Linux platform.

Exploitation requires no authentication, no user interaction, and no prior privileges on the device. Successful exploitation yields full control of the switch, including the ability to alter VLAN configuration, mirror traffic, pivot into adjacent networks, or implant persistent firmware backdoors.

Root Cause

The root cause is missing input neutralization in the PingTestSet form handler. The firmware constructs the ping command by concatenating untrusted input with a system call, rather than using parameterized execution or strict allow-list validation that restricts destIp to valid IPv4 or IPv6 literals.

Attack Vector

The attack vector is network based. An attacker sends a crafted HTTP request to /goform/PingTestSet with a malicious destIp value. The request requires only network reachability to the switch's management interface. Because many switches are deployed with management interfaces accessible across internal VLANs, lateral movement from a compromised host on the network is a likely exploitation path.

No verified public proof-of-concept code has been released for this vulnerability. The exploitation mechanism follows the well-documented pattern of goform command injection seen in numerous SOHO and small-business networking devices. See the OpenWrt Device Overview for hardware and firmware context.

Detection Methods for CVE-2026-25070

Indicators of Compromise

HTTP POST or GET requests to /goform/PingTestSet containing shell metacharacters (;, |, &, `, $() in the destIp parameter
Outbound connections initiated by the switch to unfamiliar external hosts, especially over TCP/443, TCP/4444, or non-standard ports
New or unexpected processes spawned by the web server on the switch, such as wget, curl, nc, busybox, or shell interpreters invoked from the HTTP handler
Unexpected changes to switch configuration, user accounts, or running services without corresponding administrator activity

Detection Strategies

Inspect HTTP traffic to switch management interfaces and flag requests where the destIp parameter contains characters outside the IPv4 or IPv6 character set
Deploy network IDS signatures that match the URI /goform/PingTestSet combined with shell metacharacter patterns in request bodies
Correlate authentication logs and configuration change events on the switch with the source IPs of recent management interface requests
Use NetFlow or sFlow to baseline expected egress traffic from network infrastructure and alert on deviations

Monitoring Recommendations

Restrict management interface access to a dedicated out-of-band network and monitor that segment for anomalous HTTP traffic
Enable verbose logging on perimeter and segmentation firewalls for any traffic destined to switch management addresses
Periodically validate firmware integrity and configuration baselines against a known-good reference

How to Mitigate CVE-2026-25070

Immediate Actions Required

Remove the SKS8310-8X management interface from any network segment reachable by untrusted users or workloads
Place the switch management plane behind an access control list (ACL) that permits only authorized administrator workstations
Audit recent web server and configuration logs on affected devices for evidence of exploitation attempts against /goform/PingTestSet
Rotate any shared credentials, SNMP community strings, and TACACS or RADIUS secrets configured on potentially exposed switches

Patch Information

No vendor advisory or fixed firmware version has been published in the NVD references at the time of writing. Operators should monitor the XikeStor product page on AliExpress and the OpenWrt device entry for firmware updates and contact the vendor directly to request a patched build that addresses the destIp injection in PingTestSet.

Workarounds

Disable HTTP and HTTPS management on the switch where the CLI or out-of-band serial console can be used instead
Apply firewall rules that block external access to TCP/80 and TCP/443 on switch management IP addresses
Use jump hosts with strong authentication for any administrative access to the device, and log all sessions
Where supported, deploy OpenWrt or another community firmware on the SKS8310-8X to eliminate the vulnerable goform web stack

bash

# Example ACL restricting switch management access to a single admin subnet
# Apply on the upstream router or layer-3 switch
access-list 110 permit tcp 10.10.0.0 0.0.0.255 host 10.20.0.1 eq 80
access-list 110 permit tcp 10.10.0.0 0.0.0.255 host 10.20.0.1 eq 443
access-list 110 deny   tcp any host 10.20.0.1 eq 80
access-list 110 deny   tcp any host 10.20.0.1 eq 443
access-list 110 permit ip any any