noindex and left out of the sitemap until more data is confirmed.CVE-2026-78239 is a missing-authentication flaw in Xiiaozet's LK100W industrial gateway: a critical management function can be invoked without any credentials, letting a remote attacker enable administrative services that should be restricted; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.8%
EPSS score (FIRST)
No
CISA KEV catalog
2026-08-28
Published
Vulnerability ID: CVE-2026-78239 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Xiiaozet LK100W | — | before 2.1.240 (fixed in 2.1.240, per CISA ICS Advisory ICSA-26-239-01); not yet a published NVD CPE applicability statement |
What this means
CVE-2026-78239 is a missing authentication for critical function vulnerability (CWE-306) in Xiiaozet's LK100W. NVD's description states the device "exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device" (NVD).
NVD tracks the CVE with status "Deferred" as of 2026-10-27: it records a CNA-submitted CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS v4.0 score of 9.3 (critical), but has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting the vendor/CNA figure as NVD-confirmed (NVD).
CISA's advisory ICSA-26-239-01, published 2026-08-27 as part of a batch of seven ICS advisories, confirms LK100W firmware before 2.1.240 is affected and fixed in 2.1.240; it also discloses two related flaws in the same device — CVE-2026-78037 (authenticated OS command injection via the web management interface, CVSS v3.1 8.8) and CVE-2026-76943 (an authentication weakness in an administrative service that can bypass access controls and reach command execution, CVSS v3.1 9.8) — and recommends network segmentation, firewalls and VPN access for any remote connectivity to the device (CISA ICS Advisory ICSA-26-239-01).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-27, and FIRST scores the probability of exploitation at 0.00766 (55.2th percentile) as of 2026-10-26 (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, LK100W operators should update to firmware 2.1.240 and keep the device's management interface off any network that is not already segmented and firewalled, given two other critical flaws disclosed in the same advisory.
Evidence
- LK100W exposes a critical management function reachable without authentication, letting a remote attacker enable restricted administrative services (CWE-306). — NVD
- NVD status is "Deferred" with a CNA-submitted CVSS v3.1 9.8 / v4.0 9.3, no NVD-published score or CPE configuration as of 2026-10-27. — NVD
- Affects LK100W firmware before 2.1.240, fixed in 2.1.240; disclosed alongside related CVE-2026-78037 (OS command injection, 8.8) and CVE-2026-76943 (authentication bypass, 9.8) in the same ICSA-26-239-01 advisory. — CISA ICS Advisory ICSA-26-239-01
- Not present in the CISA KEV catalog as of 2026-10-27. — CISA KEV
- EPSS score is 0.00766 (55.2th percentile) as of 2026-10-26. — FIRST EPSS
