CISA has warned that three vulnerabilities in Xiiaozet’s LK100W device could allow a remote attacker to take control of the equipment. The advisory identifies the affected product as the Xiiaozet LK100W and lists the device as used worldwide in the information technology sector. CISA published the advisory on Aug. 27, 2026. CISA lists the product status as “known_affected.”
The most serious issues involve administrative access controls. One vulnerability, CVE-2026-78239, allows a critical management function to be invoked without authentication. CISA said a remote attacker could use the weakness to enable administrative services that should be restricted, potentially gaining unauthorized access to the device. The flaw has a CVSS version 3.1 score of 9.8 and is rated critical. Its CVSS version 4.0 score is 9.3, also rated critical.
A second critical vulnerability, CVE-2026-76943, affects an administrative service’s authentication controls. CISA said an attacker may be able to bypass the intended access controls through an alternate path or channel and obtain command-execution capabilities. The weakness could permit unauthorized interaction with privileged functionality and may lead to complete device compromise. It carries a CVSS version 3.1 score of 9.8 and a CVSS version 4.0 score of 9.3, with both ratings classified as critical.
The third issue, CVE-2026-78037, is an operating-system command injection flaw in the LK100W’s web-based management interface. Unlike the two authentication-related vulnerabilities, this issue requires authentication. CISA said an authenticated attacker may be able to execute arbitrary operating-system commands with elevated privileges. Exploitation could provide unauthorized access to sensitive information or result in complete compromise of the device. The vulnerability has a CVSS version 3.1 score of 8.8 and is rated high. Its CVSS version 4.0 score is 8.7, also rated high.
CISA’s summary states that successful exploitation of the vulnerabilities could allow an attacker to take control of the LK100W. The advisory names Byron Guernsey of Okachobi, LLC, in its acknowledgment of the vulnerability reports. CISA does not report known public exploitation specifically targeting these vulnerabilities at the time of the advisory.
Xiiaozet recommends updating the LK100W to version 2.1.240. The advisory lists that version as the vendor’s mitigation for each of the three vulnerabilities. CISA advises organizations to conduct an impact analysis and risk assessment before deploying defensive measures.
CISA also recommends reducing network exposure for control-system devices and ensuring they are not accessible from the internet. It advises placing control-system networks and remote devices behind firewalls and isolating them from business networks. Where remote access is necessary, CISA recommends more secure methods such as virtual private networks, with VPN software updated to the most current version available. The agency also notes that a VPN is only as secure as the connected devices.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation. CISA separately advises users to avoid clicking web links or opening attachments in unsolicited email messages as a defense against social engineering attacks.