Vulnerabilities

CVSS

9.8 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk score

78.4

Published

2026-08-27

Status

Published

Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device.

Weaknesses

CWE-306

Coverage 1

vulnerability

Xiiaozet LK100W

The CISA has issued an advisory regarding critical vulnerabilities in the Xiiaozet LK100W device. Exploitation could allow an attacker to gain full control over the device by leveraging authentication bypass and command…

CISA Advisories · 3d ago Critical

CVE-2026-78037CVE-2026-78239CVE-2026-76943vulnerabilitycommand injectionauthentication bypass

All articles mentioning it

Advisories and references

• cisa.gov/news-events/ics-advisories/icsa-26-239-01
• github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-2...