EUVD-2026-67292
GHSA-frm2-vmcc-vghq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain network access to web management interface
-
DeliveryAuthenticate with low-privilege credentials (or bypass authentication)
-
ExploitSubmit HTTP request with shell-metacharacter-injected payload
-
ExecutionFirmware passes input unsanitized to OS shell
-
PersistExecute arbitrary commands with elevated privileges
-
ImpactAchieve full device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network-level access to the Xiiaozet LK100W web management interface (AV:N per CVSS 4.0) and a valid low-privilege account on that interface (PR:L). No non-default configuration or special feature enablement is described as required beyond the standard deployment of the web management interface. A conflicting 'Authentication Bypass' tag in the source data raises the possibility that authentication may be circumventable, potentially reducing the prerequisite to zero credentials; this is unconfirmed and must be verified against the full ICSA-26-239-01 advisory. Exploitation is bounded by: network reachability to the management port (mitigated by firewall or segmentation controls), possession of valid credentials unless auth bypass is confirmed, and the wildcard CPE suggesting all firmware versions are in scope with no safe version available. |
| Impact | The CVSS 4.0 score of 8.7 reflects network-accessible exploitation (AV:N), low attack complexity (AC:L), no special attack requirements (AT:N), a low privilege requirement (PR:L), and no required user interaction (UI:N), with full impact to the vulnerable system (VC:H/VI:H/VA:H) and no scope change to subsequent systems (SC:N/SI:N/SA:N). No EPSS data was provided in source intelligence, and no KEV listing was identified, meaning widespread automated exploitation has not been confirmed. A material discrepancy exists: the 'Authentication Bypass' tag conflicts with the PR:L (low-privilege authenticated) CVSS metric - if authentication can be bypassed, the effective exploitation barrier drops to unauthenticated network access, which would materially increase real-world risk beyond what PR:L implies; this must be verified against ICSA-26-239-01. As an OT/ICS device, network segmentation posture is a critical real-world mitigating factor, but incomplete segmentation is common in operational technology environments, potentially amplifying reachability. |
| Exploit ScenarioDerived | An attacker with low-privilege credentials to the LK100W web management interface submits a crafted HTTP request embedding shell metacharacters - such as semicolons, pipe characters, or backtick sequences - into a vulnerable form field or API parameter. The device firmware passes the unsanitized value directly to a shell interpreter, executing attacker-controlled commands with elevated (root or privileged daemon) permissions. This yields full device control, enabling credential extraction, persistent backdoor installation, configuration tampering, or use of the OT device as a network pivot. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Aug 28, 2026
OS command injection in the Xiiaozet LK100W web-based management interface enables network-accessible, low-privilege authenticated attackers to execute arbitrary operating system commands with elevated privileges, resulting in potential full device compromise. Reported by ICS-CERT under advisory ICSA-26-239-01 and scored CVSS 4.0 at 8.7 (High), this is an OT/industrial device vulnerability with high confidentiality, integrity, and availability impact to the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, an 'Authentication Bypass' tag in the source data introduces uncertainty about whether the effective exploitation prerequisite is lower than the PR:L CVSS metric indicates.
Earlier versions of this analysis (2)
OS command injection in the Xiiaozet LK100W web-based management interface allows a low-privileged attacker to execute arbitrary operating system commands with elevated privileges over the network. All versions of the LK100W are affected per the wildcard CPE, and the CISA ICS-CERT advisory (ICSA-26-239-01) confirms this as an ICS/OT-context vulnerability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the source intelligence introduces an unresolved conflict with the description's 'authenticated attacker' framing that materially affects real-world risk.
OS command injection in the Xiiaozet LK100W web-based management interface enables authenticated attackers to execute arbitrary operating system commands with elevated privileges, resulting in full device compromise including unauthorized access to sensitive information. Reported by CISA ICS-CERT under advisory ICSA-26-239-01, this affects operational technology environments where the device's management interface is network-accessible. No public exploit or CISA KEV listing is confirmed at time of analysis, but the combination of a high CVSS score, ICS-CERT reporting, and an accompanying 'Authentication Bypass' tag elevates practical risk.
RemediationAI
Consult CISA ICS Advisory ICSA-26-239-01 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-01 for vendor-specific patch guidance; patch available per vendor advisory, but an exact patched firmware version was not confirmed from the provided data - apply any firmware update released by Xiiaozet as the primary remediation. As compensating controls pending patch application: restrict network access to the web management interface exclusively to trusted management VLANs or jump hosts, blocking all untrusted network paths to the management port, which substantially reduces attacker reachability though does not remediate the underlying injection flaw; disable remote web management entirely if not operationally required, accepting the trade-off of local-only management; enforce the minimum necessary privilege level for all management accounts and rotate credentials if compromise is suspected. If the 'Authentication Bypass' tag reflects a real secondary weakness, treating this as an unauthenticated-equivalent risk and accelerating network isolation is warranted until clarified by the vendor.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 (Improper Neutralization of Special Elements used in an OS Command - OS Command Injection) describes a class of flaws where user-supplied input reaches a system shell or command interpreter without adequate sanitization, typically via calls to functions such as system(), popen(), or exec() in embedded firmware. The Xiiaozet LK100W is an OT device with a web-based management interface, consistent with the ICS-CERT reporting source and the CSAF advisory path under /OT/white/. The affected product is identified by CPE cpe:2.3:a:xiiaozet:xiiaozet_lk100w:*:*:*:*:*:*:*:*, where the wildcard version field indicates all known firmware versions are within scope. The attack surface is the HTTP-accessible management interface, consistent with the CVSS 4.0 network attack vector (AV:N) and no required attack prerequisites (AT:N).
Know when Xiiaozet Lk100W gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-accessible web interface with low-privilege authenticated requirement, no scope change, and full system impact across confidentiality, integrity, and availability.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
5DescriptionCVE.org
Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device compromise.
Executive ViewAI
A command injection vulnerability in Xiiaozet LK100W industrial control devices (CVSS 8.7) allows authenticated attackers to execute arbitrary operating system commands with elevated privileges, enabling complete device compromise. Organizations dependent on this equipment face operational disruption and loss of process control over critical industrial infrastructure. No vendor patch is currently available.
Network segmentation using firewalls and VLANs to restrict LK100W management access to authorized administrative networks; disable the web management interface if operational requirements allow; implement network-based intrusion detection configured to alert on command injection exploitation attempts; maintain detailed access logging on management interface activity; ensure offline backups and recovery procedures are current to enable rapid restoration following potential compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Xiiaozet Lk100W
View allAuthentication bypass in the Xiiaozet LK100W administrative service lets remote unauthenticated attackers reach privileg
Authentication bypass in the Xiiaozet LK100W device lets a remote attacker invoke a critical management function with no
Exploit-DB