{"id":"CVE-2026-76943","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-76943","generatedAt":"2026-10-28T02:20:10.139Z","title":"Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities.","description":"Xiiaozet LK100Wt contains an authentication weakness within an \nadministrative service that may allow an attacker to bypass intended \naccess controls and obtain command execution capabilities. Successful \nexploitation could allow unauthorized interaction with privileged \nfunctionality and may lead to complete device compromise.","published":"2026-08-28T00:18:15.000Z","lastModified":"2026-09-03T17:45:21.000Z","status":"Deferred","sourceIdentifier":"ics-cert@hq.dhs.gov","cvss":{"version":"4.0","score":9.3,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-288"],"affected":[],"epss":{"score":0.01043,"percentile":0.6387,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.04%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-239-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-01","source":"ics-cert@hq.dhs.gov"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-76943","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}