Xiiaozet LK100W CVE-2026-78239

Exploitation requires only network reachability to the LK100W's management function/interface - no credentials, no user interaction, and no special client-side configuration (consistent with AV:N/AC:L/AT:N/PR:N/UI:N). The critical prerequisite is that the vulnerable management endpoint sits on a network path the attacker can reach; the primary limiting factor is therefore network exposure - if the management interface is confined to an isolated, segmented OT network, remote exploitation is prevented, whereas an Internet-facing or flat-network deployment allows unauthenticated remote enablement of administrative services. No authentication level or non-default device configuration is required per the available data.

All available signals point to a high-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) indicates network-reachable, low-complexity exploitation with no privileges or user interaction and high impact to confidentiality, integrity, and availability of the device, yielding the 9.3 critical score. Missing-authentication bugs of this kind are typically trivially and reliably exploitable once the endpoint is reachable, consistent with AC:L/AT:N. Mitigating factors matter, however: this is an obscure OT device, so real exposure depends heavily on whether the management interface is Internet-reachable or confined to a segmented control network. EPSS and SSVC decision data were not provided in the input, the device is NOT in CISA KEV, and no public exploit is known, so exploitation probability cannot be quantified - severity rests on the CVSS vector and CWE class rather than observed exploitation. Net: treat as high priority wherever the device is deployed and reachable, but the blast radius is bounded by the product's limited deployment footprint.

An attacker who can reach the LK100W management interface - for example an unauthenticated actor on the same network segment or across an exposed WAN path - sends the crafted request that invokes the unprotected management function, switching on administrative services that should be locked down. With those services now enabled, the attacker gains unauthorized administrative access to the device and can reconfigure it or pivot further. No public proof-of-concept is identified at time of analysis.