Tinycontrol LAN Controller vulnerabilities

Latest Tinycontrol LAN Controller CVEs

Newest publication first

1. CVE-2023-54327 Tinycontrol LAN Controller 1.58a Authentication Bypass via Admin Password Change

   Published 2025-12-30

   Critical·CVSS 9.3

   Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable...

2. CVE-2023-7329 Tinycontrol LAN Controller v3 (LK3) Remote DoS

   Published 2025-11-12

   High·CVSS 8.7

   Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore factory settings, leadin...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.