Xiiaozet LK100W: 3 CVEs, Critical 9.8
Summary
CISA reports 3 vulnerabilities in Xiiaozet LK100W. Weakness types: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Missing Authentication for Critical Function, Authentication Bypass Using an Alternate Path or Channel. Successful exploitation of these vulnerabilities could allow an attacker to take control over the device. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.
At a glance
- Vendor
- Xiiaozet
- Products
- LK100W
- CVEs
- CVE-2026-78037, CVE-2026-78239, CVE-2026-76943
- Highest CVSS v3
- 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Information Technology
- Deployed
- Worldwide
- Vendor HQ
- China
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-78037 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 8.8 | – | No | Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device compromise. |
| CVE-2026-78239 | Missing Authentication for Critical Function | 9.8 | – | No | Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device. |
| CVE-2026-76943 | Authentication Bypass Using an Alternate Path or Channel | 9.8 | – | No | Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to complete device compromise. |
Affected products (1)
- Xiiaozet LK100W: <2.1.240
Vendor fixes and mitigations (from advisory)
- Mitigation: Xiiaozet recommends users update to v2.1.240.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.