LAN Controller vulnerabilities

2 known vulnerabilities in LAN Controller from Tinycontrol. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  LAN Controller: Missing Authorization

  CVE-2023-54327Dec 30, 2025Tinycontrol

  Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication

• 8.7 High severity

  Lan Controller: Missing Authentication for Critical Functionality

  CVE-2023-7329Nov 12, 2025Tinycontrol

  Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore fact