The XikeStor SKS8310-8X network switch firmware versions 1.04.B07 and prior are affected by an OS command injection vulnerability (CWE-78) in the /goform/PingTestSet endpoint. This flaw permits unauthenticated remote attackers to inject arbitrary OS commands via the destIp parameter, resulting in remote code execution with root privileges on the device. The vulnerability is remotely exploitable without authentication and has a high impact on confidentiality, integrity, and availability as indicated by the CVSS 4.0 vector and score of 9.3.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands on the network switch with root privileges, potentially leading to full compromise of the device. This can affect device confidentiality, integrity, and availability. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting network access to the management interface and disabling or limiting access to the vulnerable endpoint may reduce exposure.