CVE-2026-78239

Deferred Deferred - Pending Action

Unauthenticated Administrative Access in Xiiaozet LK100W

Publication date: 2026-08-28

Last updated on: 2026-08-31

Assigner: ICS-CERT

Description

Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-78239

EUVD

EUVD-2026-67293

Affected Vendors & Products

Vendor	Product	Version / Range
xiiaozet	lk100w	2.1.240

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

Xiiaozet LK100W has a critical management function that can be accessed without authentication. This allows remote attackers to enable administrative services that should be restricted, potentially leading to unauthorized access to the device.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized administrative services on Xiiaozet LK100W devices. Use network scanning tools like nmap to identify open ports and services. Look for unexpected administrative interfaces or services running on non-standard ports.

Impact Analysis

This vulnerability may allow unauthorized individuals to gain control over the device, potentially leading to data breaches, device manipulation, or further network compromise if the device is connected to a larger system.

Compliance Impact

Unauthorized access could result in data exposure or loss, violating privacy and security requirements under GDPR, HIPAA, and other regulations. This may lead to legal penalties, fines, or reputational damage due to non-compliance.

Mitigation Strategies

Immediately isolate affected devices from the network to prevent remote exploitation. Disable any unnecessary administrative services and restrict access to management interfaces. Update the device firmware if a patch is available from the vendor.

Hi! I’m here to help you understand CVE-2026-78239. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70