Xiiaozet LK100W: Three Vulnerabilities, Two Critical, Full Device Control at Risk

CISA Advisory of August 27 and the Three Vulnerabilities

On August 27, 2026, CISA published an advisory regarding three vulnerabilities in the Xiiaozet LK100W device, manufactured by the Chinese company Xiiaozet. The flaws, identified with three CVEs, allow an attacker to take complete control of the device. Two of them are classified as critical and are remotely exploitable without any authentication.

The bulletin, marked as ICSA-26-239-01, was published on August 27, 2026. It reports that all LK100W firmware versions prior to 2.1.240 are affected. The three vulnerabilities are:

• CVE-2026-78037 – OS Command Injection (CWE-78), high severity. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
• CVE-2026-78239 – Missing Authentication for Critical Function (CWE-306), critical severity. CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
• CVE-2026-76943 – Authentication Bypass Using an Alternate Path or Channel (CWE-288), critical severity. CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

In detail, CVE-2026-78037 allows an authenticated attacker to inject system commands through the management web interface, executing arbitrary code with elevated privileges. CVE-2026-78239 exposes a critical management function without requiring authentication, allowing a remote attacker to enable reserved administrative services. CVE-2026-76943 bypasses authentication controls via an alternative channel, providing unauthorized command execution capabilities.

How an Attacker Can Exploit Them: Technical Details and Scores

The three vulnerabilities affect different components of the device, but converge on the same outcome: total compromise.

CVE-2026-78037 is a classic OS command injection. The attacker must be authenticated, but once inside can execute arbitrary commands with elevated privileges. This type of flaw occurs when the web application passes unvalidated input to a system shell. The impact is high on confidentiality, integrity, and availability.

The other two vulnerabilities remove the authentication barrier. CVE-2026-78239 allows invoking a critical function without credentials: a remote attacker can enable administrative services, effectively gaining unauthorized access. CVE-2026-76943 acts on an alternative path or channel to bypass intended controls. Both have CVSS 3.1 of 9.8 and CVSS 4.0 of 9.3, the highest severity level.

Note a minor inconsistency in the product name: the description of CVE-2026-76943 reports "Xiiaozet LK100Wt", while official metadata indicates "LK100W". Most likely this is a typographical error.

Versions, Products, and Distribution: Who Must Act

The affected versions are all LK100W firmware versions prior to 2.1.240. The manufacturer is Xiiaozet, based in China. The sector indicated by CISA is Information Technology. Distribution is worldwide.

It is unclear how many devices are exposed. However, since this is a network product intended for IT infrastructures, the risk affects organizations that use it as a management or control device. The advisory does not provide details on the installed base.

No specific patch has been indicated by CISA at the time of publication. The advisory does not report corrective instructions from the manufacturer. This leaves users in a delicate position: they must apply general mitigations while waiting for a firmware update.

Mitigations: How to Defend Without a Patch

CISA recommends minimizing network exposure of these devices. In particular:

• Avoid direct Internet accessibility.
• Place devices behind firewalls, isolating them from corporate networks.
• If remote access is necessary, use VPNs updated to the latest version.
• Perform an impact analysis and risk assessment before applying defensive measures.

The agency also suggests consulting control systems security practices at cisa.gov/ics and the document "Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies". For detection and mitigation of targeted intrusions, the technical document ICS-TIP-12-146-01B is cited.

There are no reports of public exploitation specifically targeting these vulnerabilities at the time of publication. However, the combination of two critical flaws without authentication and a third high-impact one makes the device an attractive target. Administrators should monitor logs for suspicious activity and report any anomalies to CISA.

Reporting and Exploitation Status: No Known Attacks, but Eyes Open

The vulnerabilities were reported to CISA by Byron Guernsey of Okachobi, LLC. The researcher identified the three flaws and communicated them to the agency, which then issued the advisory.

As of August 27, 2026, CISA has not received reports of active exploitation. Inclusion in the KEV (Known Exploited Vulnerabilities) catalog is not mentioned in the advisory. This means that, at the moment, there is no evidence of ongoing attacks. However, cybersecurity history teaches that critical unpatched vulnerabilities can be quickly exploited once made public.

Users of the Xiiaozet LK100W should prepare for a firmware update as soon as it becomes available. In the meantime, network isolation and segmentation remain the most effective defenses. CISA's recommendation on social engineering – do not open links or attachments in unsolicited emails – should also be applied in this context, because initial access could occur via phishing.

In summary: three vulnerabilities, two critical, one high. Full control of the device is within an attacker's reach. The watchword is isolate, monitor, and update as soon as possible.