What is the CVSS score of CVE-2026-25072?

CVE-2026-25072 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Zikestor Sks8310 8x Firmware are affected by CVE-2026-25072?

XikeStor SKS8310-8X network switches running firmware 1.04.B07 and earlier are vulnerable to session hijacking attacks that could allow unauthorized administrative access without credentials.

How to fix or mitigate CVE-2026-25072?

Within 24 hours: Inventory all XikeStor SKS8310-8X switches and document firmware versions; restrict network access to management interfaces to trusted administrative networks only. Within 7 days: Contact XikeStor for patch availability and ETA; implement network segmentation to isolate affected switches from untrusted segments; enable enhanced logging on affected devices. Within 30 days: Apply vendor patch immediately upon release; audit all administrative access logs for suspicious session activity; reset all administrator credentials post-patching.

Zikestor Sks8310 8x Firmware CVE-2026-25072

CRITICAL

Use of Insufficiently Random Values (CWE-330)

2026-03-07 disclosure@vulncheck.com

Authentication Bypass Zikestor Sks8310 8x Firmware Seekswan

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 07, 2026 - 01:15 nvd

CRITICAL 9.8

DescriptionCVE.org

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier vulnerability in the /goform/SetLogin endpoint that allows remote attackers to hijack authenticated sessions. Attackers can predict session identifiers using insufficiently random cookie values and exploit exposed session parameters in URLs to gain unauthorized access to authenticated user sessions.

AnalysisAI

Predictable session identifier generation in XikeStor SKS8310-8X network switch allows session hijacking even if the command injection (CVE-2026-25070) is patched.