CVE-2026-78239

CRITICAL9.8Published on August 28, 2026

Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device.

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-306

Xiiaozet LK100W: tre vulnerabilità, due critiche, il controllo completo del dispositivo è a rischio

Vulnerabilities

Xiiaozet LK100W: Three Vulnerabilities, Two Critical, Full Device Control at Risk

On August 27, 2026, CISA published an advisory regarding three vulnerabilities in the Xiiaozet LK100W device, manufactured by the Chinese company

Aug 28, 20264 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Xiiaozet LK100W: Three Vulnerabilities, Two Critical, Full Device Control at Risk