CVE-2026-78037: Xiiaozet LK100W OS Command Injection
Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device compromise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Xiiaozet LK100Wto a version that resolves this vulnerability.Fixed in v2.1.240
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs network access to the device's web-based management interface and an authenticated account with low privileges. No user interaction is required.
Which deployments are realistically exposed?
Xiiaozet LK100W devices are exposed when their web-based management interface is reachable by an attacker who can authenticate. The provided data does not identify affected firmware versions or configuration-specific limitations.
What should teams expect if exploitation succeeds?
Successful exploitation may allow arbitrary operating-system command execution with elevated privileges. This can lead to access to sensitive information or complete device compromise.
Are fixed versions or temporary mitigations provided?
The supplied data does not include a fixed version, patch information, or temporary mitigation guidance.