Description
Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls and modify administrative credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Tinycontrol | LAN Controller | HW 3.8, Unknown – ≤ 1.58a | — |
References
- ExploitDB-51732 exploit
- Tinycontrol Official Product Homepage product
- Zero Science Lab Disclosure (ZSL-2023-5787) third-party-advisory
- VulnCheck Advisory: Tinycontrol LAN Controller 1.58a Authentication Bypass via Admin Password Change third-party-advisory