VulnSocial

CVE-2026-78239Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-08-28); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-08-28: 1Mentions · 2026-08-29: 1Technical Details · 2026-08-29: 108-2808-29
Signal classification1 categories
Disclosure
2100.0%
Referenced assets1 URL
By indicator
Full discourse2 posts
  • Daily CyberSecurity@Daily_CyberSec
    Disclosure

    CISA warns that Xiiaozet LK100W vulnerabilities, including CVE-2026-78239, allow attackers to take full control of affected devices. Update now. #Xiiaozet #LK100W #CISA #Vulnerability #Cybersecurity #CVE202678239 https://securityonline.info/xiiaozet-lk100w-vulnerabilities/

    Post summary

    CISA issues a warning about CVE-2026-78239 affecting Xiiaozet LK100W devices, stating it could allow full device takeover and urging users to update promptly.

    00001455
    12.9K followersView on X
  • NewsTongue@NewsTongueX
    Disclosure

    🔴 Xiiaozet LK100W critical flaws allow unauthenticated remote command execution Xiiaozet LK100W industrial devices running firmware versions below 2.1.240 contain three critical vulnerabilities (CVE-2026-78037, CVE-2026-78239, CVE-2026-76943) that permit remote attackers to execute arbitrary OS commands with elevated privileges, potentially resulting in complete device compromise. The flaws span OS command injection through the web management interface, unauthenticated access to critical management functions, and authentication bypass in administrative services.

    Post summary

    Xiiaozet LK100W devices with firmware below 2.1.240 are vulnerable to three critical flaws (CVE-2026-78037, CVE-2026-78239, CVE-2026-76943) that allow unauthenticated remote command execution via web interface, critical function access, and admin service bypass.

    0000045
    811 followersView on X

Explore more

Back to dashboard