🔴 Xiiaozet LK100W critical flaws allow unauthenticated remote command execution Xiiaozet LK100W industrial devices running firmware versions below 2.1.240 contain three critical vulnerabilities (CVE-2026-78037, CVE-2026-78239, CVE-2026-76943) that permit remote attackers to execute arbitrary OS commands with elevated privileges, potentially resulting in complete device compromise. The flaws span OS command injection through the web management interface, unauthenticated access to critical management functions, and authentication bypass in administrative services.
Post summary
The announcement reveals three critical vulnerabilities in Xiiaozet LK100W firmware that enable unauthenticated remote command execution through command injection, access, and authentication bypass flaws.