PT-2025-50266 · Unknown · Tinycontrol Lan Controller V3 Lk3

Published 2025-12-09 · Updated 2025-12-10 · CVE-2023-53739

Positive Technologies (AI Summary)

CVSS v4.0

9.9

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Tinycontrol LAN Controller v3 LK3 version 1.58a

Description The Tinycontrol LAN Controller v3 LK3 version 1.58a has an issue that allows remote attackers to download configuration backup files containing sensitive credentials without authentication. Specifically, attackers can retrieve the lk3 settings.bin file and extract base64-encoded user and admin passwords. The lk3 settings.bin file contains sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-260

Related Identifiers

CVE-2023-53739

Affected Products

Tinycontrol Lan Controller V3 Lk3

References · 9

• 🔥 https://exploit-db.com/exploits/51731 · Exploit
• https://zeroscience.mk/en/vulnerabilities/ZSL-2023-5786.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53739 · Security Note
• https://vulncheck.com/advisories/tinycontrol-lan-controller-v3-lk3-unauthenticated-configuration-backup-disclosure · Note
• https://vulncheck.com/advisories/tinycontrol-lan-controller-v-lk-a-unauthenticated-configuration-backup-disclosure · Note
• https://tinycontrol.pl · Note
• https://twitter.com/0dayPublishing/status/1998496755353006509 · Twitter Post
• https://twitter.com/CVEnew/status/1998732789219573968 · Twitter Post
• https://t.me/CVEtracker/39295 · Telegram Post