CISA 2026-08-27

Xiiaozet LK100W

Machine-generated analysis · WAYSCloud LLM

Xiiaozet LK100W devices with firmware earlier than 2.1.240 are vulnerable to OS command injection and unauthenticated management functions.

Context

The advisory identifies the Xiiaozet LK100W as the affected product. It states that versions prior to 2.1.240 allow an attacker to inject OS commands via the web management interface and to invoke a management function without authentication, potentially leading to full device compromise. The vendor advises updating to firmware version 2.1.240 to mitigate the issues.

Operator considerations

Check: Identify any Xiiaozet LK100W devices running firmware versions earlier than 2.1.240.
Patch: Apply the vendor-provided update to version 2.1.240.
Isolate: Restrict network access to the device’s web management interface to trusted hosts only.
Log: Monitor web management traffic for unauthorized command attempts.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow an attacker to take control over the device.

The following versions of Xiiaozet LK100W are affected:

LK100W

Read the full advisory on CISA →