# CVE-2026-78239: Xiiaozet LK100W missing authentication in critical management function

Source: https://junglewise.ai/threats/cve-2026-78239-xiiaozet-lk100w-missing-authentication-in-critical-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78239 · Severity: critical · CVSS 9.8 · Published 2026-08-28

The Xiiaozet LK100W is an industrial control system device used in critical infrastructure environments worldwide. This vulnerability allows a remote attacker to invoke a critical management function without any authentication, enabling them to activate restricted administrative services and gain unauthorized access to the device. Successful exploitation could lead to complete device compromise and loss of control over connected infrastructure.

Technologies: [Xiiaozet LK100W](https://junglewise.ai/threats/technologies/lk100w). Vendors: [Xiiaozet](https://junglewise.ai/threats/vendors/xiiaozet).

## Quick answers

**Is CVE-2026-78239 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78239 being exploited in the wild.

**How severe is CVE-2026-78239?** Critical severity, with a CVSS score of 9.8, published 28 August 2026.

**Which products and versions are affected?** Xiiaozet LK100W <2.1.240.

**Is there a fix for CVE-2026-78239?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78239 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-78239?** Check whether you run Xiiaozet LK100W at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authentication flaw (CWE-306) in the LK100W's web-based management interface that exposes a critical administrative function. An unauthenticated remote attacker can directly invoke this function over the network without providing credentials, allowing them to enable administrative services that should be access-restricted. This leads to unauthorized device access and can be chained with other vulnerabilities (CVE-2026-78037, CVE-2026-76943) to achieve complete system compromise. The flaw affects all versions before 2.1.240, and Xiiaozet has released a patched version addressing this issue.

## Affected products

- Xiiaozet LK100W <2.1.240

## Timeline

- 2026-08-27: disclosed
- 2026-08-28: advisory

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-239-01.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-239-01.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-01](https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-01)

## Related threats

- [Xiiaozet LK100W OS command injection in web management interface](https://junglewise.ai/threats/cve-2026-78037-xiiaozet-lk100w-os-command-injection-in-web-management-interface)
- [Xiiaozet LK100W authentication bypass in administrative service](https://junglewise.ai/threats/cve-2026-76943-xiiaozet-lk100w-authentication-bypass-in-administrative-service)