CVE-2026-25073 is a stored cross-site scripting vulnerability in Anhui Seeker Electronic Technology Co., LTD.'s XikeStor SKS8310-8X network switch firmware versions 1.04.B07 and prior. Authenticated attackers can inject arbitrary script code through the System Name field, which is improperly encoded on output. This allows malicious scripts to execute in the context of a victim's browser when the stored data is viewed. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS 4.0 base score is 5.1, indicating medium severity. There is no indication of known exploits in the wild or available patches.

An authenticated attacker can inject malicious scripts that execute in the browsers of users who view the compromised System Name field. This can lead to unauthorized actions performed in the context of the victim's session, potentially compromising user data or session integrity. However, the attack requires authentication and user interaction (viewing the stored value), limiting the scope and impact. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device management interface to trusted users only. Validate and sanitize input fields where possible and consider monitoring for suspicious activity related to the System Name field. Avoid viewing or sharing the System Name field content with untrusted users.