CVE-2026-76943: CWE-288 in Xiiaozet Xiiaozet LK100W

The Xiiaozet LK100W contains an authentication weakness (CWE-288) within an administrative service that may allow an attacker to bypass intended access controls. Successful exploitation grants command execution capabilities, enabling unauthorized interaction with privileged functionality and possibly resulting in complete device compromise. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been documented at this time, and no known exploits are reported in the wild.

An attacker exploiting this vulnerability can bypass authentication controls to execute commands with administrative privileges on the Xiiaozet LK100W device. This could lead to unauthorized control over the device, compromising confidentiality, integrity, and availability, and potentially resulting in complete device takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the administrative service and monitor for unauthorized access attempts as precautionary measures.