Description
Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore factory settings, leading to a denial of service and configuration loss.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
tinycontrol Lan Controller
Default version status: unaffected
0 to ≤ 1.58aaffected
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5785.php ↗
- https://packetstormsecurity.com/files/174455/ ↗
- https://www.exploit-db.com/exploits/51730 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/275810 ↗
- https://tinycontrol.pl/en/archives/lan-controller-35/ ↗
- https://www.vulncheck.com/advisories/tinycontrol-lan-controller-v3-remote-dos ↗