Vulnerability · Published Mar 7, 2026 · Assigned by VulnCheck

CVE-2026-25072XikeStor SKS8310-8X Predictable Session Identifiers

High 8.6

In plain English

A high-severity weak randomness in XikeStor SKS8310-8X from Anhui Seeker Electronic Technology Co., LTD.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.6%top 53.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier vulnerability in the /goform/SetLogin endpoint that allows remote attackers to hijack authenticated sessions. Attackers can predict session identifiers using insufficiently random cookie values and exploit exposed session parameters in URLs to gain unauthorized access to authenticated user sessions.

Affected products (as reported)

Vendor	Product	Versions
Anhui Seeker Electronic Technology Co., LTD.	XikeStor SKS8310-8X	0 – through 1.04.B07

Weakness: CWE-330 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References