The flaw is a stored cross‑site scripting vulnerability that permits an authenticated attacker to inject arbitrary script code into the System Name field of the XikeStor SKS8310-8X network switch. When an user views the stored value, the injected script is executed in that user's browser because the firmware does not perform proper output encoding. The ability to run arbitrary code could permit a malicious script to steal session data, deface the interface, or execute further commands within the web interface context.

All instances of Anhui Seeker Electronic Technology Co., LTD’s XikeStor SKS8310‑8X network switch running firmware versions 1.04.B07 or earlier are affected. The vulnerability is present in the device’s web administration interface where the System Name can be edited by authenticated users.

The CVSS v3 score of 5.1 indicates medium severity. The EPSS score is reported as less than 1%, signaling a very low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker first authenticate to the switch, after which they can alter the System Name. The injected script payload is then executed only when a user with a browser view of the configuration pages accesses the stored data, limiting the attack surface. In practice, the risk is moderate, but the need for privileged access reduces the likelihood of widespread compromise. The likely attack vector involves a network or local administrator who misuses legitimate credentials to inject malicious code.