Critical Unauth Flaws in Xiiaozet LK100W Demand Immediate Patching

As reported by CISA in advisory ICSA-26-239-01, the Xiiaozet LK100W network device contains three vulnerabilities — CVE-2026-78037, CVE-2026-78239, and CVE-2026-76943 — that collectively allow remote attackers to seize full control of affected units. The most severe of the trio requires no authentication whatsoever, making this a high-priority remediation target for any organization deploying this hardware.

What makes this advisory particularly concerning is the chaining potential. An unauthenticated attacker can first exploit CVE-2026-78239 to enable restricted administrative services, then leverage CVE-2026-76943's authentication bypass to access those services through an alternate path, and finally use CVE-2026-78037's OS command injection to execute arbitrary code with elevated privileges. This is a textbook kill-chain that takes a device from internet-exposed to fully compromised in minutes.

Vulnerability Summary

Affected Products

Patch Availability

A firmware update to version 2.1.240 is available and addresses all three CVEs. No active exploitation in the wild has been confirmed at time of advisory publication, but the unauthenticated nature of two of these flaws makes rapid weaponization likely.

Who Is Most at Risk

Organizations in the Information Technology critical infrastructure sector are explicitly named, but given worldwide deployment, any environment using LK100W devices as network gateways or edge connectivity appliances is exposed. Small and mid-sized enterprises are disproportionately at risk here — they are more likely to run default configurations, less likely to have segmented management networks, and typically slower to apply firmware patches to non-data-center equipment.

Devices with management interfaces reachable from the internet face the highest risk. The unauthenticated CVE-2026-78239 can be exploited with a single crafted request, meaning automated scanning will find and compromise these devices within hours of any public PoC release.

Shield53 Recommendations

Immediate Actions

• Update firmware to v2.1.240 immediately on all Xiiaozet LK100W devices. This is the only complete remediation.
• Restrict management interface access — block inbound connections to the web management port from untrusted networks. Allow only from a dedicated management VLAN or VPN.
• Inventory and identify all LK100W units in your environment. Check edge sites, branch offices, and remote facilities where lesser-known equipment often goes unmonitored.
• Deploy WAF or reverse proxy rules in front of any LK100W management interface that cannot be immediately patched. Filter for command injection patterns and anomalous administrative API calls.
• Monitor logs for exploitation indicators — unexpected service enablement events, administrative logins from unusual source IPs, or web interface requests containing shell metacharacters (;, |, &, $()).

Detection Guidance

Look for HTTP requests to the management interface containing encoded shell commands or requests to administrative service endpoints that bypass normal authentication flows. Alert on any successful response from service-enablement endpoints that does not correspond to a legitimate administrator session.

The combination of unauthenticated access and command injection on the same device means that network-level controls alone are insufficient. Patching is the only durable fix — do not assume your firewall posture will hold indefinitely against a remotely exploitable critical vulnerability on a device designed to sit at the network edge.

Shield53 assesses that the window between advisory publication and active exploitation for unauthenticated ICS device vulnerabilities is typically 7–14 days. Organizations should treat this as a same-week remediation obligation, not a monthly patch cycle item.