Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2023-53739

Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3_settings.bin file and extract base64-encoded user and admin passwords without authentication.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Tinycontrol Tinycontrol LAN Controller v

Default version status: unaffected

  • <=1.58aaffected
  • HW 3.8affected

Tinycontrol LK

Default version status: unaffected

  • <=1.58aaffected
  • HW 3.8affected

References