Xiiaozet
Monthly
Authentication bypass in the Xiiaozet LK100W administrative service lets remote unauthenticated attackers reach privileged functionality and obtain command execution, per CISA ICS advisory ICSA-26-239-01. Because the flawed check guards an admin interface, a successful bypass leads to full device takeover. No public exploit has been identified at time of analysis, and the device is not listed in CISA KEV.
Authentication bypass in the Xiiaozet LK100W device lets a remote attacker invoke a critical management function with no credentials, switching on administrative services that should stay restricted and opening a path to unauthorized device access. Tracked as CVE-2026-78239 and published in CISA ICS advisory ICSA-26-239-01, it carries a CVSS 4.0 base score of 9.3 (critical). No public exploit is identified at time of analysis, and the device is not listed in CISA KEV.
OS command injection in the Xiiaozet LK100W web-based management interface enables network-accessible, low-privilege authenticated attackers to execute arbitrary operating system commands with elevated privileges, resulting in potential full device compromise. Reported by ICS-CERT under advisory ICSA-26-239-01 and scored CVSS 4.0 at 8.7 (High), this is an OT/industrial device vulnerability with high confidentiality, integrity, and availability impact to the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, an 'Authentication Bypass' tag in the source data introduces uncertainty about whether the effective exploitation prerequisite is lower than the PR:L CVSS metric indicates.
Authentication bypass in the Xiiaozet LK100W administrative service lets remote unauthenticated attackers reach privileged functionality and obtain command execution, per CISA ICS advisory ICSA-26-239-01. Because the flawed check guards an admin interface, a successful bypass leads to full device takeover. No public exploit has been identified at time of analysis, and the device is not listed in CISA KEV.
Authentication bypass in the Xiiaozet LK100W device lets a remote attacker invoke a critical management function with no credentials, switching on administrative services that should stay restricted and opening a path to unauthorized device access. Tracked as CVE-2026-78239 and published in CISA ICS advisory ICSA-26-239-01, it carries a CVSS 4.0 base score of 9.3 (critical). No public exploit is identified at time of analysis, and the device is not listed in CISA KEV.
OS command injection in the Xiiaozet LK100W web-based management interface enables network-accessible, low-privilege authenticated attackers to execute arbitrary operating system commands with elevated privileges, resulting in potential full device compromise. Reported by ICS-CERT under advisory ICSA-26-239-01 and scored CVSS 4.0 at 8.7 (High), this is an OT/industrial device vulnerability with high confidentiality, integrity, and availability impact to the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, an 'Authentication Bypass' tag in the source data introduces uncertainty about whether the effective exploitation prerequisite is lower than the PR:L CVSS metric indicates.