Xiiaozet LK100W

Xiiaozet LK100Wt devices contain an authentication weakness (CWE-288) in an administrative service that allows an attacker to bypass intended access controls. Per the CVSS 4.0 vector, the flaw is reachable over a network with no privileges required and no user interaction, meaning a remote attacker can trigger it directly against the service. A successful attacker gains the ability to execute commands on the device, which the vendor-advisory language indicates may lead to complete device compromise. Only owners and operators of Xiiaozet LK100Wt devices are affected, particularly any units whose administrative interface is reachable from untrusted networks. No public proof-of-concept or confirmed in-the-wild exploitation is known; the 0.7% EPSS probability and absence from CISA KEV indicate low near-term exploitation risk.

Do: Check the CISA ICS advisory for the affected version range and apply the vendor's fixed firmware as soon as it is available; the data provided does not include fixed version numbers. Until patched, restrict network exposure: avoid port-forwarding the device to the internet, place it on an isolated VLAN or behind a firewall, and limit access to its administrative service. Review device logs for unexpected connections or unexplained configuration changes that could indicate attempted exploitation.

CVE-2026-78037 is an OS command injection flaw (CWE-78) in the web-based management interface of the Xiiaozet LK100W. An attacker who has valid low-privileged credentials can send crafted input to the interface to execute arbitrary operating system commands on the device. Because the injected commands run with elevated privileges, a successful attack can expose sensitive information or lead to complete compromise of the device, which the CVSS 4.0 score of 8.7 (high) reflects with high confidentiality, integrity, and availability impact. Any organization running a Xiiaozet LK100W, especially where the management web interface is reachable from untrusted networks, is in the affected population. There is currently no public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at about 1.2%, so no exploitation is known at this time.

Do: Check the CISA ICS advisory and Xiiaozet's advisories for the affected and fixed firmware versions and update the LK100W to the patched firmware as soon as it is available. In the meantime, restrict access to the device's web management interface to trusted management networks or VPN users, enforce strong unique administrator credentials, and review device logs for unexpected commands or configuration changes.

Xiiaozet LK100W exposes a critical management function that can be reached over the network without any authentication (CWE-306), letting an unauthenticated remote attacker enable administrative services that should be restricted. The flaw is triggered simply by sending a request to the exposed management function, requiring no credentials, privileges, or user interaction. A successful attacker can activate privileged management services and gain unauthorized access to the device, with high potential impact on its confidentiality, integrity, and availability. Any deployment running an LK100W, especially one reachable from untrusted networks, is potentially affected; the advisory was coordinated by CISA ICS-CERT. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS assigns roughly a 0.6% probability of exploitation within 30 days.

Do: Restrict network access to the LK100W management interface (firewall rules, ACLs, or an isolated management VLAN) and check whether administrative services were enabled unexpectedly on exposed units. Apply the latest vendor firmware as soon as Xiiaozet publishes a fix, and monitor the CISA ICS-CERT advisory for affected/fixed version details, which are not yet specified in the available data.