CISA Advises Critical Vulnerabilities in Xiiaozet LK100W IoT Device

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-239-01 on August 27, 2026, warning of three vulnerabilities affecting the Xiiaozet LK100W networking device. The affected product is the Xiiaozet LK100W wireless router with firmware versions prior to 2.1.240.

CVE-2026-78037 is an OS command injection vulnerability in the web-based management interface. An authenticated attacker may execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device compromise. The CVSS v3.1 base score is 8.8 (HIGH), and the CVSS v4.0 base score is 8.7 (HIGH).

CVE-2026-78239 is an authentication bypass vulnerability. A critical management function can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. The CVSS v3.1 base score is 9.8 (CRITICAL), and the CVSS v4.0 base score is 9.3 (CRITICAL).

CVE-2026-76943 is an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. The CVSS v3.1 base score is 9.8 (CRITICAL), and the CVSS v4.0 base score is 9.3 (CRITICAL).

Xiiaozet attributes the discovery of these vulnerabilities to Byron Guernsey of Okachobi, LLC, who reported them to CISA. The vendor recommends users update to version 2.1.240 to remediate the flaws.

CISA recommends minimizing network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locating control system networks and remote devices behind firewalls and isolating them from business networks is advised. When remote access is required, more secure methods such as Virtual Private Networks (VPNs) should be used, and VPNs should be updated to the most current version available. CISA also reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

As of the advisory date, no public exploitation of these vulnerabilities has been reported. However, the high CVSS scores and the nature of the flaws — particularly the unauthenticated command execution and authentication bypass issues — present significant risk to affected deployments, especially those exposed to external networks.