Tinycontrol Lan Controller vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Tinycontrol Lan Controller: 2 record(s), with affected versions and fixes.
CVE-2023-54327
Critical · 9.8
CWE-862 Dec 30, 2025
Tinycontrol LAN Controller 1.58a Authentication Bypass via Admin Password Change
Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls and modify administrative credentials.
CVE-2023-7329
High · 8.7
CWE-306 Nov 12, 2025
Tinycontrol LAN Controller v3 (LK3) Remote DoS
Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore factory settings, leading to a denial of service and configuration loss.