Xiiaozet's LK100W lets an unauthenticated caller switch on its admin services

Take the three findings in the order an attacker would use them: the unauthenticated management call first, the alternate-path bypass second, the command injection last, because that is where the elevated privileges arrive. CISA does not assert that the three chain. The sequence comes from inference based on the CWE classes and the fact that all three sit in the same firmware below the same version ^[15], and that inference is what carries the entire priority argument. Here, the same build that contains the command injection bug also ships the unauthenticated call that creates the authenticated session the bug depends on, collapsing the usual assumption that a login-gated command injection is a post-authentication problem you can schedule at leisure ^[15].

The advisory is thin exactly where triage happens. The three CVE IDs are listed together against the affected version, and the three vulnerability write-ups are labeled by CWE rather than by CVE, so you cannot tell from the document which identifier is the unauthenticated one ^[11]. The Metrics sections carry no score and no vector ^[12]. It gives no port and no model variant list.

The remediation is simpler than the paperwork around it. A single string, v2.1.240, is Xiiaozet's answer to all three ^[6], so one firmware install per unit retires three CVEs, and that install is the only device-specific action in the document ^[13]. Everything else on offer is CISA's standing ICS guidance: keep the device off the internet, put it behind a firewall away from business networks, and use a VPN when remote access is genuinely required ^[10].

Scoping is blunt: the affected range covers every build below 2.1.240 with no lower bound, so owners have to treat every unit as in scope rather than narrowing the work to a subset of older builds ^[14].

Byron Guernsey of Okachobi, LLC reported the bugs to CISA ^[8], and the vendor produced a fixed build, which is the part of this that functions as it should. The exploitation line in the advisory describes what has been reported to CISA ^[7], not how many LK100W management interfaces currently answer from the internet. CISA lists the deployment as worldwide, the sector as Information Technology, and Xiiaozet's headquarters as China ^[9]. A worldwide footprint on a low-profile device makes locating the units the hard part; patching them, once found, is the easy part.