Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: tinycontrol Clear all filters
TI-2025-10536 CVE-2025-11500 · GHSA-822w-crcw-46rx

Credentials exposure in tinycontrol devices

Priority MEDIUM 40

Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources.

CVSS 4.0HIGH 8.7 Adjacent network No auth No interaction EPSS 0.0033 Published 2026-03-16 Fixed in 1.67, 1.75 +2 CWE-201
TI-2025-14225 CVE-2025-15587 · GHSA-p5qr-79pr-g4vp

Credentials exposure in tinycontrol devices

Priority LOW 38

Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface.

CVSS 4.0HIGH 8.6 Adjacent network Low privileges No interaction EPSS 0.00175 Published 2026-03-16 Fixed in 1.67, 1.75 +2 CWE-425
TI-2023-06696 CVE-2023-7329 · GHSA-2h8p-f7xr-xcpg

Tinycontrol LAN Controller v3 (LK3) Remote DoS

Priority LOW 39

Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00745 Published 2025-11-12 No fix listed CWE-306