CVE-2026-78037CWE-78command-injection

CVE-2026-78037

High · published August 28, 2026

CVSS v3.1
8.8
EPSS
2%
Percentile
79.2
In the wild
Unconfirmed
What it is

Xiiaozet LK100W is vulnerable to OS command injection through its

web-based management interface. An authenticated attacker may be able to

execute arbitrary operating system commands with elevated privileges,

potentially resulting in unauthorized access to sensitive information or

complete device compromise.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01868 · 79.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-28T04:18Z
References (2)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-239-01.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-01 · [email protected]
EPSS history
Timeline
  • 27 AUG 21:46Z
    Xiiaozet LK100W OS Command Injection
    cvelistv5