XikeStor SKS8310-8X Network Switch OS Command Injection Vulnerability Allowing Remote Code Execution

An OS command injection vulnerability has been identified in the XikeStor SKS8310-8X network switch, affecting firmware versions through 1.04.B07. The vulnerability exists in the '/goform/PingTestSet' endpoint, where unauthenticated remote attackers can inject malicious commands via the 'destIp' parameter. This exploitation allows for arbitrary operating system command execution with root privileges on the affected switch.

Impact

Exploitation of this vulnerability leads to unauthorized execution of operating system commands with root privileges on the affected network switch.