Xiiaozet LK100W
CISA warns of three flaws, including OS command injection, in Xiiaozet LK100W devices before firmware 2.1.240 that allow attackers to take full control of the device.
CISA published ICS advisory ICSA-26-239-01 covering three vulnerabilities (CVE-2026-78037, CVE-2026-78239, CVE-2026-76943) in Xiiaozet LK100W devices running firmware below 2.1.240. The issues include OS command injection, missing authentication for critical functions, and authentication bypass via an alternate path, rated CVSS v3 9.8. Successful exploitation allows an attacker to take control of the device. The China-based vendor's equipment is deployed worldwide, including information technology critical infrastructure sectors.
- CVSS 9.8 flaw set enables full device takeover
- Weaknesses: OS command injection, missing authentication, authentication bypass
- Fixed in firmware 2.1.240 or later
- Deployed worldwide across IT critical infrastructure
- Vendors
- Xiiaozet
- Products
- Xiiaozet LK100W
- Organizations
- CISA
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76943 | Authentication Bypass Enables Remote Command Execution in Xiiaozet LK100Wt | 9.3 | <1% | ||
CVE-2026-78239+1 related CVE | Missing Authentication on Xiiaozet LK100W Exposes Critical Management Function | 9.3 group max | <1% |
From the original article
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to take control over the device. The following versions of Xiiaozet LK100W are affected: LK100W <2. 1.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.