CVE-2026-78239

CriticalCVSS 9.8

Published: 28/08/2026(UTC)Updated: 31/08/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.55%

44th percentile - higher than 44% of all known CVEs

Summary

The Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device.

Risk Assessment

An attacker can gain unauthorized access to administrative functions of the device, potentially leading to full device compromise.

Recommendation

Restrict network access to the device and enforce authentication for all management functions.

Other vulnerabilities in Xiiaozet LK100W

CVE-2026-78037High
Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device compromise.

Original NVD description (English source)

Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS