Description
Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3_settings.bin file and extract base64-encoded user and admin passwords without authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Tinycontrol | Tinycontrol LAN Controller v | <=1.58a, HW 3.8 | — |
| Tinycontrol | LK | <=1.58a, HW 3.8 | — |
References
- ExploitDB-51731 exploit
- Tinycontrol Product Homepage product
- Zero Science Lab Advisory ID vendor-advisory
- VulnCheck Advisory: Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure third-party-advisory