Tinycontrol vulnerabilities
We track 5 vulnerabilities in Tinycontrol products across 8 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on March 16, 2026.
Latest Tinycontrol vulnerabilities
- 8.6 High severity
Lan Kontroler v3.5: Direct Request
Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface. This issue has been fixed in firmware v
- 8.7 High severity
Lan Kontroler v3.5: Insertion of Sensitive Information Into Sent Data
Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources. When the latter is turned off (which is a default se
- 9.8 Critical severity
LAN Controller: Missing Authorization
Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication
- 9.9 Critical severity
Tinycontrol LAN Controller v: Password in Configuration File
Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3_settings.bin file and extract base64-
- 8.7 High severity
Lan Controller: Missing Authentication for Critical Functionality
Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore fact