CVE-2026-78239

EUVD-2026-67293
Xiiaozet LK100W exposes a critical management function that can be 
invoked without authentication, allowing a remote attacker to enable 
administrative services that should be restricted. Successful 
exploitation may permit unauthorized access to the device.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 43.74%
Common Weakness Enumeration
References
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-239-01.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-01