Xiiaozet LK100W is vulnerable to OS command injection through its web‑based management interface. An authenticated attacker may execute arbitrary operating system commands with elevated privileges, potentially leading to unauthorized access to sensitive information or full device compromise.

Xiiaozet LK100W devices are impacted. The vendor recommends updating to v2.1.240, indicating that firmware versions earlier than this release are likely vulnerable. The web‑based management interface serves as the attack entry point and requires authentication.

The CVSS score of 8.7 indicates high severity. With no EPSS data available and the vulnerability not listed in KEV, the exploitation probability remains uncertain, but attackers who possess or compromise legitimate credentials can quickly elevate privileges and control the device. The attack vector is the web‑based management interface accessed over trusted networks or by authorized users.