CVE-2026-76943: Xiiaozet LK100W Authentication Bypass Using an Alternate Path or Channel

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-09-03
Weakness: CWE-288

Description

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to complete device compromise.

Affected products

Xiiaozet LK100W: before 2.1.240 — fixed in 2.1.240

How to fix

Upgrade to a fixed version: Xiiaozet LK100W 2.1.240. Check the vendor advisory for mitigations.

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-239-01.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-01

Get alerted when CVE-2026-76943 or the next vulnerability affects your stack