CISA warns of critical Xiiaozet LK100W flaws, urges update to v2.1.240

CISA on Aug. 27 published an advisory on Xiiaozet LK100W vulnerabilities affecting versions earlier than 2.1.240 and warned that successful exploitation could allow an attacker to take control of the device.

The agency rates two of the three flaws as critical and says the product is deployed worldwide in the information technology sector. CISA also said it has not seen known public exploitation specifically targeting these vulnerabilities so far.

The advisory lists CVE-2026-78037 as an OS command injection issue in the web-based management interface. CISA said an authenticated attacker could use it to run arbitrary operating system commands with elevated privileges, which could expose sensitive information or lead to full device compromise. CISA gave that flaw a CVSS v3.1 score of 8.8 and a CVSS v4.0 score of 8.7, both rated high.

CISA also listed CVE-2026-78239, a missing-authentication flaw in a critical management function. According to the advisory, a remote attacker could use it to enable administrative services and gain unauthorized access to the device. CISA rated that flaw 9.8 under CVSS v3.1 and 9.3 under CVSS v4.0, both critical.

The third issue, CVE-2026-76943, is an authentication bypass weakness in an administrative service. CISA said it could let an attacker bypass access controls, obtain command execution capabilities and potentially fully compromise the device. The agency also rated that flaw 9.8 under CVSS v3.1 and 9.3 under CVSS v4.0, both critical.

CISA identified Xiiaozet LK100W versions earlier than 2.1.240 as known affected. The advisory says Xiiaozet recommends updating to v2.1.240. Background fields in the notice list the company headquarters location as China.

The advisory names Byron Guernsey of Okachobi, LLC as the reporter to CISA. It was first released on Aug. 27.

CISA says control system devices and networks should not be exposed to the internet, and that remote access, when required, should use secure methods such as VPNs kept up to date.

Sources

• CISA advisory: Xiiaozet LK100W

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.