The $63 Print Server With Two Unauthenticated 9.8s: Xiiaozet LK100W, CISA ICSA-26-239-01

The short version//

You bought a $63 box so your office printer could be on the network. It has a web UI, it sits on your LAN, and its entire reason for existing is to be there — always on, always reachable, doing the most boring job in the building. CISA just gave that box a 9.8.

The advisory (ICSA-26-239-01, published 2026-08-27) covers the Xiiaozet LK100W, a Chinese wireless USB print server that lists at $62.99 on the vendor's own store — 2.4G Wi-Fi, 100Mbps Ethernet, one USB 2.0 port, and a web management interface that does the configuring. Three CVEs, all fixed in firmware 2.1.240, and two of them don't even need you to log in. CISA's summary line: "Successful exploitation of these vulnerabilities could allow an attacker to take control over the device."

No known public exploitation yet. Which means you're in the best window you're ever going to get: it's rated, it's documented, and nobody has knocked on the door in public. That window closes when someone does.

What the LK100W is (if you don't own one)//

For non-IT people: a print server is a tiny box with a USB port on one side and a network port (or Wi-Fi) on the other. It exists because a lot of the world's printers still only speak USB, and you'd rather have the whole office print to one IP address than run a USB cable to a specific desk. The LK100W adds a web-based management interface and a mobile app (print PDFs, images, and documents from a phone) on top, and it speaks RAW / IPP over TCP/IP — the standard network-printing protocols, so it's compatible with "over 95% of USB printers" per the product page.

That web management interface is the whole story. It's the part an attacker reaches, and it's the part with the bugs.

The three CVEs, in plain English//

The headline vulnerabilities, all on firmware < 2.1.240:

CVE	CVSS 3.1	What it is, translated
CVE-2026-78239	9.8 (CWE-306)	A critical management function is exposed with no authentication — a remote attacker can enable administrative services that should be restricted, opening the door to the device. The front door is unlocked.
CVE-2026-76943	9.8 (CWE-288)	An authentication bypass inside an administrative service — an attacker can slip past the intended access controls and reach command execution. The "lock" is a suggestion.
CVE-2026-78037	8.8 (CWE-78)	OS command injection through the web management interface — an authenticated attacker can inject commands that run with elevated privileges, reaching for sensitive info or full device compromise.

Two of those are unauthenticated (PR:N in the vector) and score 9.8 — the maximum short of a 10. The third needs a login but is a straight command injection, which is the kind of bug that turns "logged in as a regular user" into "running commands as the box."

The exact CVSS 3.1 vectors, straight from the advisory:

• CVE-2026-78239 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H → 9.8 CRITICAL
• CVE-2026-76943 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H → 9.8 CRITICAL
• CVE-2026-78037 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H → 8.8 HIGH

Who's exploiting it (spoilery: nobody in public yet)//

CISA: "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time." Reported by Byron Guernsey of Okachobi, LLC. The sector on the advisory is Information Technology; deployment is worldwide; the vendor is in China. Read that the way you'd read any ICS advisory we've covered — the devices are cheap, the devices are everywhere, and the one thing they all have in common is a web UI that someone configured once and never touched again.

This is the same beat as the Ebyte NA111-M serial server we covered yesterday — cheap Chinese edge gear with an admin interface, rated by CISA, unexploited in public. The long tail of "it's cheap, it's networked, and it has a login page" keeps producing 9.8s. The LK100W is just the newest entry.

What you should do//

1. Find your LK100Ws. Check your DHCP client table, your Pi-hole/AdGuard query log, or your switch's ARP cache — they announce themselves. Then check the firmware version in the web UI; if it's < 2.1.240, you're in scope.
2. Update to firmware 2.1.240. That's the fix for all three CVEs. The vendor's store and support site carry the firmware and an installation tool. Verify the version string afterward — print-server firmware updates are the kind of thing that silently no-ops.
3. Keep it off the internet. CISA's standing guidance for ICS gear: minimize network exposure, don't let it be reachable from the internet, and locate it behind a firewall, isolated from your business network. If you need remote access, use a VPN.
4. VLAN it off the main LAN. A print server's entire world is the printer on its USB port and the machines that print to it. Give it its own VLAN and let only the printers and print clients talk to it. This is the single highest-ROI move if you can't patch today.
5. Kill the default credentials on the web UI, and don't leave the admin interface exposed to a segment you don't trust.
6. If you can't segment it, the honest fallback is a VPN or IP allowlist in front of the admin UI — or a different print server.

One scoping note: the advisory is specifically for the LK100W (the 2.4G Wi-Fi / 100Mbps Ethernet variant). The product page also lists a 5G Wi-Fi / Gigabit Ethernet variant — don't assume the 2.1.240 fix covers that one without checking.