PT-2025-46734 · Unknown · Tinycontrol Lan Controller

Gjoko Krstic · Published 2025-11-12 · Updated 2025-11-13 · CVE-2023-7329

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Tinycontrol LAN Controller versions up to 1.58a (hardware v3.8)

Description The Tinycontrol LAN Controller v3 (LK3) firmware has a missing authentication check. An attacker who is not authenticated can send specially crafted requests to the stm.cgi API endpoint. This can force the device to reboot or restore factory settings, resulting in a denial of service and loss of configuration. The stm.cgi endpoint is vulnerable to unauthorized access.

Recommendations Versions prior to 1.58a (hardware v3.8) should be updated.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-7329

Affected Products

Tinycontrol Lan Controller

References · 8

• 🔥 https://packetstormsecurity.com/files/174455 · Exploit
• 🔥 https://exploit-db.com/exploits/51730 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2023-5785.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-7329 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/275810 · Note
• https://vulncheck.com/advisories/tinycontrol-lan-controller-v3-remote-dos · Note
• https://tinycontrol.pl/en/archives/lan-controller-35 · Note
• https://twitter.com/CVEnew/status/1988820421106708895 · Twitter Post