5 mincritical
Xiiaozet LK100W (CVE-2026-78037, CVE-2026-78239, CVE-2026-76943)
CISA published an ICS advisory detailing three vulnerabilities in Xiiaozet LK100W devices running firmware versions prior to 2.1.240. The vulnerabilities include OS command injection, missing authentication for critical functions, and authentication bypass, which could allow unauthenticated remote attackers to achieve complete device compromise.
Sens:▲ 24hConf:high
Showing defanged values
- cveCVE-2026-76943Authentication bypass using an alternate path or channel allows attackers to bypass access controls and obtain command execution capabilities.
- cveCVE-2026-78037OS command injection vulnerability in the web-based management interface allows authenticated attackers to execute arbitrary operating system commands with elevated privileges.
- cveCVE-2026-78239Missing authentication for a critical management function allows remote attackers to enable restricted administrative services without credentials.
Detection / Hunteropenrouter
What Happened
A security advisory has been issued for a device called the Xiiaozet LK100W. The device has three security flaws that could allow attackers to take full control of it without needing a password. The flaws affect devices running older software versions. Anyone using this device should update it to version 2.1.240 immediately and ensure the device is not directly accessible from the internet.
Key Takeaways
- Xiiaozet LK100W devices with firmware versions below 2.1.240 are affected by three critical vulnerabilities.
- CVE-2026-78239 and CVE-2026-76943 allow unauthenticated remote attackers to bypass access controls and gain command execution capabilities.
- CVE-2026-78037 allows authenticated attackers to execute arbitrary OS commands with elevated privileges via the web management interface.
- Successful exploitation of these vulnerabilities can result in complete device compromise.
- The vendor has released firmware version 2.1.240 to remediate these issues.
Affected Systems
- Xiiaozet LK100W (firmware versions < 2.1.240)
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-78037 | Xiiaozet LK100W | High | OS command injection vulnerability in the web-based management interface allows authenticated attackers to execute arbitrary operating system commands with elevated privileges. |
| CVE-2026-78239 | Xiiaozet LK100W | Critical | Missing authentication for a critical management function allows remote attackers to enable restricted administrative services without credentials. |
| CVE-2026-76943 | Xiiaozet LK100W | Critical | Authentication bypass using an alternate path or channel allows attackers to bypass access controls and obtain command execution capabilities. |
Attack Chain
- Initial Access: Attacker targets the web-based management interface of an exposed Xiiaozet LK100W device.
- Exploitation: Attacker exploits CVE-2026-78239 or CVE-2026-76943 to bypass authentication and access critical management functions.
- Execution: Attacker leverages CVE-2026-78037 to inject and execute arbitrary OS commands with elevated privileges.
- Impact: Attacker gains complete control of the device, potentially accessing sensitive information or using it for further attacks.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the advisory.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The affected device is an IoT/network appliance. EDR agents are unlikely to be installed on this type of equipment, limiting endpoint telemetry. |
| Network Visibility | Medium | Network traffic to the web management interface of the device could be monitored for exploitation attempts, but specific payload signatures are not provided in the advisory. |
| Detection Difficulty | Moderate | Detection relies on network-level monitoring and device-specific logs, which may not be consistently available or forwarded to a central SIEM in all environments. |
Required Log Sources
- Web server logs from the Xiiaozet LK100W device
- Network firewall logs
- IDS/IPS logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for HTTP requests targeting the Xiiaozet LK100W web management interface that contain OS command injection patterns or attempt to access unauthenticated administrative endpoints. | Network IDS/IPS logs, firewall logs, web proxy logs | Initial Access / Exploitation | Medium - Administrative traffic or vulnerability scanners may trigger similar patterns. |
Control Gaps
- Signature-based network controls may miss exploitation attempts without specific payload signatures.
- Lack of network segmentation exposing the device management interface to untrusted networks.
Key Behavioral Indicators
- HTTP requests to the Xiiaozet LK100W management interface containing command injection characters or unexpected parameters
- Unauthenticated access attempts to critical management functions on the device
- Anomalous outbound traffic from the Xiiaozet LK100W device indicating post-compromise activity
False Positive Assessment
Medium - Detection based on network traffic to the management interface may generate false positives from legitimate administrative activity or vulnerability scanning.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider updating affected Xiiaozet LK100W devices to firmware version 2.1.240 or later immediately.
- If updating is not immediately possible, consider restricting network access to the device's management interface by placing it behind a firewall or VPN.
Infrastructure Hardening
- Evaluate whether Xiiaozet LK100W devices need to be accessible from the internet. If not, ensure they are isolated on internal, restricted network segments.
- Consider implementing network-level access controls to limit which IP addresses can communicate with the device's management interface.
User Protection
- Ensure that administrators use strong, unique passwords for the device's management interface, even though the primary vulnerabilities involve authentication bypass, to reduce risk from other potential attack vectors.
Security Awareness
- Consider incorporating information about these vulnerabilities into existing security awareness programs for IT and OT staff responsible for managing network appliances.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping2 techniques
Tactic
Initial Access
Tactic
