CVE-2026-76943

Deferred Deferred - Pending Action

Authentication Bypass in Xiiaozet LK100Wt

Publication date: 2026-08-28

Last updated on: 2026-09-03

Assigner: ICS-CERT

Description

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to complete device compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-76943

EUVD

EUVD-2026-67294

Affected Vendors & Products

Vendor	Product	Version / Range
xiiaozet	lk100wt	to 2.1.240 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

CVE-2026-76943 is an authentication bypass vulnerability in the Xiiaozet LK100Wt device. It allows attackers to bypass access controls and gain command execution without proper authentication, potentially leading to complete device compromise.

Detection Guidance

To detect this vulnerability, check if your Xiiaozet LK100Wt device is running a version prior to 2.1.240. Use network scanning tools like nmap to identify devices and their firmware versions. Commands like 'nmap -p 80,443 <device_ip>' can help identify open ports and services.

Impact Analysis

This vulnerability could allow unauthorized individuals to interact with privileged functions on the device, potentially gaining full control over it. This may lead to data theft, device manipulation, or disruption of services relying on the device.

Compliance Impact

This vulnerability could lead to unauthorized access and control of the Xiiaozet LK100Wt device, potentially exposing sensitive data or system functions. This may violate compliance requirements under GDPR and HIPAA, which mandate strict access controls and protection of personal or health information. Unauthorized access could result in data breaches, non-compliance penalties, and reputational damage.

Mitigation Strategies

Update the Xiiaozet LK100Wt device to version 2.1.240 or later to address the authentication bypass vulnerability.

Hi! I’m here to help you understand CVE-2026-76943. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70