EUVD-2026-67294
GHSA-6x82-vfrh-gxpc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach LK100W admin service over network
-
DeliverySend request via alternate auth path
-
ExploitBypass authentication check
-
ExecutionInvoke privileged command execution
-
ImpactAchieve full device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | Exploitation requires network reachability to the Xiiaozet LK100W administrative service; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication, no user interaction, and no special attack requirements against the exposed admin interface. The concrete precondition is that the vulnerable administrative service is network-accessible to the attacker - in typical ICS deployments this service should sit on an isolated OT segment, so the principal limiting factor is network exposure: an LK100W whose admin service is confined to a segmented, firewalled network is not reachable remotely, whereas one exposed to IT or the internet is trivially exploitable. No non-default configuration, credential, or client interaction is needed once the service is reachable. |
| Impact | The supplied CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3 Critical) describes a fully remote, low-complexity, unauthenticated attack with high confidentiality, integrity, and availability impact - a maximal-severity profile consistent with an unauthenticated admin bypass yielding command execution. Mitigating the raw score: this is an obscure ICS/OT device with a limited deployment footprint, and there is no EPSS score, no KEV listing, and no POC in the provided data, so exploitation is currently theoretical rather than demonstrated. The signals are internally consistent (CVSS vector, CWE-288, and description all point to trivial remote abuse), so the primary uncertainty is missing exploitation telemetry - EPSS and POC status are simply absent rather than conflicting. Treat as high priority for any organization actually running the LK100W with a network-reachable admin service, but a low aggregate-risk item for the general population given the narrow install base. |
| Exploit ScenarioDerived | An attacker with network reachability to the LK100W's administrative service sends a crafted request that follows an alternate path around the intended authentication check, is treated as an authorized operator, and invokes privileged command-execution functionality. With no authentication, user interaction, or special preconditions required, the attacker gains control of the device and can disrupt or manipulate the process it governs. No public POC is currently available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 28, 2026
Authentication bypass in the Xiiaozet LK100W administrative service lets remote unauthenticated attackers reach privileged functionality and obtain command execution, per CISA ICS advisory ICSA-26-239-01. Because the flawed check guards an admin interface, a successful bypass leads to full device takeover. No public exploit has been identified at time of analysis, and the device is not listed in CISA KEV.
Earlier versions of this analysis (1)
Authentication bypass in the Xiiaozet LK100W device's administrative service lets remote attackers reach privileged functionality and gain command execution, per CISA ICS advisory ICSA-26-239-01. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) describes network-reachable, unauthenticated exploitation that can lead to full device compromise. No public exploit code or CISA KEV listing is present in the source data.
RemediationAI
No vendor-released patch or fixed version is identified in the provided data; consult CISA ICS advisory ICSA-26-239-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-01) and its CSAF file (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-239-01.json) for the authoritative fix and vendor mitigations. Until a patch is confirmed, apply ICS network-isolation controls: remove the LK100W administrative service from any internet exposure and place the device behind a firewall on a segmented OT network so the admin interface is unreachable from IT/corporate and external zones (trade-off: remote management must then be brokered through a hardened jump host or VPN). Restrict access to the admin service to an explicit allowlist of engineering-workstation IPs and require a VPN for remote administration (trade-off: added operational friction for field maintenance). Monitor the admin service for anomalous or unauthenticated requests as a detective control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected asset is the Xiiaozet LK100W (CPE cpe:2.3:a:xiiaozet:xiiaozet_lk100w), an OT/ICS device tracked through CISA's ICS advisory program (reported by icscert). The root cause is CWE-288, Authentication Bypass Using an Alternate Path or Channel: an administrative service exposes privileged functionality reachable without satisfying the intended authentication check, so an attacker following an alternate request path or channel is treated as an authorized operator. Because the exposed admin functionality includes command execution, the authentication weakness escalates directly into control of the underlying device rather than mere information disclosure.
Know when Xiiaozet Lk100W gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated bypass of an admin service (AV:N/AC:L/PR:N/UI:N) yielding command execution gives full C/I/A impact on the device; scope unchanged as impact stays on the device.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
4DescriptionCVE.org
Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to complete device compromise.
Executive ViewAI
Xiiaozet LK100W industrial controllers contain a critical authentication bypass flaw (CVE-2026-76943, CVSS 9.3) allowing remote unauthenticated attackers to gain full administrative control and execute arbitrary commands. Although no public exploit identified at time of analysis, the vulnerability exposes organizations to immediate risk of unauthorized device takeover and potential operational outages across critical infrastructure. Affected devices require urgent inventory, isolation, and monitoring until patches become available.
No vendor-released patch identified at time of analysis. Interim mitigations include: network segmentation to restrict access to the LK100W administrative interface to trusted management networks only; implement firewall rules to block remote access from untrusted sources; deploy network monitoring and alerting for suspicious access patterns to the device; maintain audit logs of all administrative access attempts; evaluate temporary device shutdown or replacement with patched alternatives if operational criticality permits.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Xiiaozet Lk100W
View allAuthentication bypass in the Xiiaozet LK100W device lets a remote attacker invoke a critical management function with no
OS command injection in the Xiiaozet LK100W web-based management interface enables network-accessible, low-privilege aut
Exploit-DB