What’s Vulnerable › Vulnerabilities

CVE-2026-78037: Xiiaozet LK100W OS Command Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-28 · updated 2026-08-31
• Weakness: CWE-78

Description

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device compromise.

Affected products

• Xiiaozet LK100W: before 2.1.240 — fixed in 2.1.240

How to fix

Upgrade to a fixed version: Xiiaozet LK100W 2.1.240. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-239-01.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-01

Get alerted when CVE-2026-78037 or the next vulnerability affects your stack