PT-2025-54254 · Unknown · Tinycontrol Lan Controller

Published 2025-12-30 · Updated 2025-12-31 · CVE-2023-54327

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tinycontrol LAN Controller version 1.58a

Description An authentication bypass allows unauthenticated attackers to change admin passwords. This is achieved by sending a crafted API request to the /stm.cgi endpoint with a specially crafted authentication parameter, disabling access controls and allowing modification of administrative credentials. The vulnerable parameter is the authentication parameter within the API request.

Recommendations Apply any available updates to address the authentication bypass. As a temporary workaround, restrict access to the /stm.cgi endpoint.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-54327

Affected Products

Tinycontrol Lan Controller

References · 8

• 🔥 https://exploit-db.com/exploits/51732 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2023-5787.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-54327 · Security Note
• https://osv.dev/vulnerability/CVE-2023-54327 · Vendor Advisory
• https://vulncheck.com/advisories/tinycontrol-lan-controller-a-authentication-bypass-via-admin-password-change · Note
• https://tinycontrol.pl · Note
• https://twitter.com/CVEnew/status/2006332240666726435 · Twitter Post
• https://t.me/CVEtracker/41010 · Telegram Post