ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Xiiaozet”

2 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAdvisory 1Vulnerability 1
SeverityAllcritical 0high 2medium 0low 0info 0

Xiiaozet LK100W

CISA warns of three flaws, including OS command injection, in Xiiaozet LK100W devices before firmware 2.1.240 that allow attackers to take full control of the device.

CISA published ICS advisory ICSA-26-239-01 covering three vulnerabilities (CVE-2026-78037, CVE-2026-78239, CVE-2026-76943) in Xiiaozet LK100W devices running firmware below 2.1.240. The issues include OS command injection, missing authentication for critical functions, and authentication bypass via an alternate path, rated CVSS v3 9.8. Successful exploitation allows an attacker to take control of the device. The China-based vendor's equipment is deployed worldwide, including information technology critical infrastructure sectors.

CISA Advisories · 20d agoAdvisoryCVE-2026-78037CVE-2026-78239CVE-2026-76943

ICS Patch Tuesday: Schneider Electric, Siemens Fix Critical Flaws

September ICS Patch Tuesday brings critical fixes from Schneider Electric, Siemens, and Aveva, including CVSS 9.2 authentication flaw CVE-2026-3869 in Modicon M580 controllers.

Schneider Electric's September advisories include a critical authentication vulnerability, CVE-2026-3869 with a CVSS score of 9.2, in Modicon M580 and Modicon M580 Safety controllers, plus high-severity bugs in PowerLogic T300 and EcoStruxure IT Data Center Expert. Siemens published nine new advisories, four rated critical across Reyrolle 7SR5, Open Interface Services, Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT, and began rolling out fixes for CVE-2026-31431, a 7.8-rated Linux kernel flaw enabling root shell access. Aveva disclosed four flaws in Pipeline Integrity Monitor's PIMBoards, including a hardcoded encryption key and MD5-hashed passwords, plus an unsafe deserialization issue in Enterprise SCADA. Rockwell Automation separately issued nine advisories covering RSLinx Classic and multiple controller products.

SecurityWeek · 7d agoVulnerabilityCVE-2026-3869CVE-2026-31431