PT-2026-25661 · Tinycontrol · Lk3.9+3

Paweł Różański · Published 2026-03-16 · Updated 2026-03-16 · CVE-2025-11500

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions tcPDU versions prior to 1.36 LAN Controller LK3.5 versions prior to 1.67 LAN Controller LK3.9 versions prior to 1.75 LAN Controller LK4 versions prior to 1.38

Description Tinycontrol devices, including tcPDU and LAN Controllers LK3.5, LK3.9, and LK4, have two authentication mechanisms: one for interface management and another for other server resources. When the latter is disabled (the default setting), an unauthenticated attacker on the local network can retrieve usernames and encoded passwords for the interface management portal by examining the HTTP response from the login page, which includes a JSON file containing these credentials. Both standard and administrator user credentials are exposed.

Recommendations tcPDU: Update to firmware version 1.36 or later. LAN Controller LK3.5: Update to firmware version 1.67 or later. LAN Controller LK3.9: Update to firmware version 1.75 or later. LAN Controller LK4: Update to firmware version 1.38 or later.

Fix

Weakness Enumeration

CWE-201

CWE-261

Related Identifiers

CVE-2025-11500

Affected Products

Lk3.9

Lk4

Lan Kontroler V3.5

Tcpdu

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-11500 · Security Note
• https://twitter.com/CVEnew/status/2033583682183958602 · Twitter Post
• https://cert.pl/en/posts/2026/03/CVE-2025-11500 · Note
• https://tinycontrol.pl/en/tcpdu/downloads/#firmware · Note
• https://t.me/CVEtracker/47529 · Telegram Post
• https://tinycontrol.pl/en/lk39/downloads/#firmware · Note
• https://tinycontrol.pl/en/archives/lan-controller-35/downloads/#firmware · Note
• https://tinycontrol.pl/en/lk4/downloads/#firmware · Note
• https://securitum.com/CVE-2025-11500 · Note