Will Xiiaozet LK100W devices be actively exploited via CVE-2026-78037/78239/76943 by Sept 2026?

CISA has alerted to three critical vulnerabilities (CVSS 9.8) in Xiiaozet LK100W versions <2.1.240 allowing attacker takeover. No open market covers exploitation of this specific device firmware vulnerability.

Resolution Criteria

Public documentation from CISA KEV, vendor advisories, or security researchers confirming active exploitation (PoC, malware samples, or victim reports) of any of the three CVEs in Xiiaozet LK100W before Sept 30, 2026.