CVE-2026-78037

HIGH8.8Published on August 28, 2026

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device compromise.

CVSS score8.8 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-78

Xiiaozet LK100W: tre vulnerabilità, due critiche, il controllo completo del dispositivo è a rischio

Vulnerabilities

Xiiaozet LK100W: Three Vulnerabilities, Two Critical, Full Device Control at Risk

On August 27, 2026, CISA published an advisory regarding three vulnerabilities in the Xiiaozet LK100W device, manufactured by the Chinese company

Aug 28, 20264 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Xiiaozet LK100W: Three Vulnerabilities, Two Critical, Full Device Control at Risk