External risk intelligence

Xiiaozet LK100Wt Administrative Service Authentication Bypass Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-76943

The vulnerability affects an administrative service in a product that is commonly deployed as an internet-facing device or edge gateway. Administrative interfaces on these types of products are frequently exposed to the network to facilitate management, making them a likely target for remote access.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The Xiiaozet LK100Wt contains a critical security flaw in its administrative service that could allow attackers to bypass access controls and gain command execution. This could lead to unauthorized control and full compromise of the device.

Administrative service flaw allows unauthorized command execution.
Critical flaw could lead to complete device compromise.
Confirm relevance and potential exposure to business operations.

Attack Path

How an attacker could exploit the issue

An attacker could remotely access an administrative service on the device, bypassing access controls due to an authentication weakness. This could lead to the execution of commands, allowing unauthorized access to privileged functions and potentially a full compromise of the device.

No authentication needed for access.
Triggered by interacting with the administrative service.
Risks unauthorized command execution.

Live Threat

Current exploitation, exposure, and threat context

An authentication weakness in an administrative service could allow an attacker to bypass access controls and gain command execution capabilities. When supported by the advisory, this could lead to unauthorized interaction with privileged functionality and complete device compromise.

Administrative service access and control.
Attackers bypass access controls.
Complete device compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Xiiaozet LK100Wt's administrative service vulnerability requires attention from teams managing network-facing infrastructure and device security. The immediate first step is to identify all deployed instances of this technology, determine their exposure to external networks, and ascertain their criticality to business operations. Once these devices are located and their risk profile understood, the accountable owner must be identified to plan for remediation.

Infrastructure and security teams own remediation.
Verify external reachability and business criticality.
Plan coordinated maintenance for device updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Xiiaozet LK100Wt?

The Xiiaozet LK100Wt is a networking device often deployed as an edge gateway or administrative infrastructure component. It provides essential management functions, acting as a bridge or control point within a network environment. Because it serves as a central hub for configuration and oversight, it manages sensitive administrative traffic.

What does CVE-2026-76943 mean for security?

This CVE describes an authentication weakness, specifically classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). It means the device's security gate can be circumvented, allowing someone to interact with administrative features without providing valid credentials. Essentially, the software fails to verify who is making the request, which can result in unauthorized command execution.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by interacting directly with the device's administrative service over the network. Because the vulnerability exists in the authentication mechanism itself, no prior valid login or existing user account is required to initiate the attack. Normal, non-administrative traffic or attempts that do not interface with this specific management service will not trigger the bug.

Why is this device likely exposed to the internet?

Halo Surface Signal indicates that the LK100Wt is commonly deployed as an edge gateway or internet-facing device. Since the affected administrative service is often left accessible to the network to simplify remote management, these devices are highly reachable by external actors. This visibility significantly increases the likelihood that the vulnerability can be reached remotely.

What should I do if I use this device?

Start by locating every instance of the LK100Wt within your environment to understand your total footprint. Prioritize checking which devices are accessible from the public internet, as these carry the highest immediate risk. Once you have identified these assets, coordinate with your infrastructure teams to confirm the device's role, determine the owner, and plan the necessary maintenance or security updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.