Update Xiiaozet LK100W firmware to version 2.1.240 or later. As interim mitigations, minimize network exposure by ensuring the device is not accessible from the internet, locate it behind firewalls and isolate it from business networks, and use updated VPNs for any required remote access. Perform impact analysis and risk assessment before deploying defensive measures.
Quick answers
What is CVE-2026-78037?
Update Xiiaozet LK100W firmware to version 2.1.240 or later. As interim mitigations, minimize network exposure by ensuring the device is not accessible from the internet, locate it behind firewalls and isolate it from business networks, and use updated VPNs for any required remote access. Perform impact analysis and risk assessment before deploying defensive measures.
How severe is CVE-2026-78037?
critical, CVSS 9.8
Is CVE-2026-78037 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-78037 be mitigated?
Update Xiiaozet LK100W firmware to version 2.1.240 or later. As interim mitigations, minimize network exposure by ensuring the device is not accessible from the internet, locate it behind firewalls and isolate it from business networks, and use updated VPNs for any required remote access. Perform impact analysis and risk assessment before deploying defensive measures.
CVSS
9.8
Vendor
Xiiaozet
Published
Sep 30, 2026 · 08:05
Patch
Unknown / not confirmed
Affected products
Xiiaozet LK100W
Mitigation
Update Xiiaozet LK100W firmware to version 2.1.240 or later. As interim mitigations, minimize network exposure by ensuring the device is not accessible from the internet, locate it behind firewalls and isolate it from business networks, and use updated VPNs for any required remote access. Perform impact analysis and risk assessment before deploying defensive measures.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an industrial control systems advisory (ICSA-26-239-01) detailing three vulnerabilities in the Xiiaozet LK100W wireless router. The flaws, tracked as CVE-2026-78037, CVE-2026-78239, and CVE-2026-76943, affect firmware versions below 2.1.240. Successful exploitation could allow an attacker to execute arbitrary operating system commands, bypass authentication, and gain unauthorized administrative access, potentially leading to complete device compromise. Xiiaozet recommends updating to firmware version 2.1.240 or later as the primary remediation.