CVE-2026-78239: Xiiaozet LK100W Auth Bypass Vulnerability

CVE-2026-78239 Overview

CVE-2026-78239 is a missing authentication vulnerability [CWE-306] in the Xiiaozet LK100W device. The flaw allows a remote, unauthenticated attacker to invoke a critical management function that should require authentication. Successful exploitation enables administrative services that are meant to be restricted, providing unauthorized access to the device.

The vulnerability was disclosed through CISA ICS Advisory ICSA-26-239-01 and carries an EPSS probability of 0.552%.

Critical Impact
Remote, unauthenticated attackers can enable restricted administrative services on affected LK100W devices, exposing confidentiality, integrity, and availability of the device.

Affected Products

Xiiaozet LK100W (see CISA ICS Advisory ICSA-26-239-01 for version details)
Deployments exposing LK100W management interfaces to untrusted networks
Industrial control system (ICS) environments referencing LK100W as an operational component

Discovery Timeline

2026-08-28 - CVE-2026-78239 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-78239

Vulnerability Analysis

The Xiiaozet LK100W exposes a management function that performs a security-sensitive action — enabling restricted administrative services — without validating the identity of the requester. An attacker reaching the device over the network can invoke this function directly. Once triggered, administrative services that should remain disabled or gated behind authentication become reachable.

Because the function is invoked over the network without user interaction, it can be scripted and executed at scale against exposed devices. Post-exploitation activity may include configuration changes, credential material access, or pivoting into segments the device connects to.

Root Cause

The root cause is classified as Missing Authentication for Critical Function [CWE-306]. The management endpoint that toggles administrative services does not enforce an authentication check before executing the requested action. The design assumes network-level trust rather than validating identity per request.

Attack Vector

The attack vector is network-based and does not require privileges or user interaction. An attacker sends a request to the exposed management function on the LK100W device and receives the ability to enable administrative services. From that point, attackers can leverage those services for further access. No public proof-of-concept or exploit code is currently referenced in the advisory.

Refer to the CISA ICS Advisory ICSA-26-239-01 and the associated CSAF JSON document for authoritative technical details.

Detection Methods for CVE-2026-78239

Indicators of Compromise

Unexpected activation of administrative services (for example, remote management, Telnet, SSH, or web admin) on LK100W devices.
Inbound network requests to LK100W management endpoints from addresses outside the operational network.
Configuration drift on LK100W devices where administrative service states change without a corresponding change ticket.

Detection Strategies

Monitor network flows to and from LK100W devices for connections originating from untrusted or internet-facing segments.
Alert on any state transition of administrative services on LK100W devices, correlating with authenticated administrator sessions to identify unauthorized enablement.
Compare running device configuration against a known-good baseline on a scheduled interval and flag deviations.

Monitoring Recommendations

Capture and retain access logs from the LK100W and its upstream network devices for forensic review.
Enable NetFlow, sFlow, or equivalent telemetry on switches adjacent to the LK100W to observe scanning and management traffic.
Integrate ICS network monitoring alerts into the SOC pipeline with clear ownership for triage.

How to Mitigate CVE-2026-78239

Immediate Actions Required

Remove any direct internet exposure of LK100W management interfaces and place the device behind a firewall.
Restrict management access to a defined allowlist of engineering workstations using ACLs on upstream switches or firewalls.
Audit LK100W devices for administrative services that are currently enabled and disable any that are not required.
Rotate credentials on the device and on connected systems if unauthorized service enablement is suspected.

Patch Information

At the time of publication, the NVD entry for CVE-2026-78239 does not list a vendor patch. Consult the CISA ICS Advisory ICSA-26-239-01 for the latest vendor guidance and any firmware updates from Xiiaozet.

Workarounds

Segment LK100W devices onto isolated ICS/OT VLANs with no route to corporate or internet networks.
Require VPN plus multi-factor authentication for any operator or engineer accessing the LK100W management plane.
Deploy protocol-aware ICS monitoring to detect and alert on unauthorized management commands reaching the device.
Physically disable unused network interfaces on the LK100W where operationally feasible.

bash

# Example firewall rule to restrict LK100W management access to an engineering subnet
# Replace <LK100W_IP> and <ENGINEERING_SUBNET> with values for your environment
iptables -A FORWARD -s <ENGINEERING_SUBNET> -d <LK100W_IP> -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s <ENGINEERING_SUBNET> -d <LK100W_IP> -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d <LK100W_IP> -j DROP