CVE-2026-25072 is a vulnerability in Anhui Seeker Electronic Technology Co., LTD.'s XikeStor SKS8310-8X network switch firmware (version 1.04.B07 and prior). It involves the use of insufficiently random values for session identifiers at the /goform/SetLogin endpoint. This predictability enables remote attackers to hijack authenticated sessions by guessing session cookies and exploiting session parameters exposed in URLs. The vulnerability is classified under CWE-330 and has a CVSS 4.0 base score of 8.6, indicating high severity. No patch or official fix information is available, and the product is not a cloud service.

Successful exploitation allows remote attackers to hijack authenticated sessions on affected devices, potentially gaining unauthorized access to management interfaces. This can lead to unauthorized control or configuration changes on the network switch. There are no known exploits in the wild, but the vulnerability's high CVSS score reflects significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the management interface to trusted networks and monitor for suspicious activity. Avoid exposing the device management interface to untrusted networks. No vendor-provided patches or temporary fixes are currently documented.