CVE-2023-54327

CRITICAL

Tinycontrol Lan Controller Firmware < 1.58a - Missing Authorization

Title source: rule

Description

Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls and modify administrative credentials.

Exploits (1)

exploitdb WORKING POC

by LiquidWorm · textremotehardware

https://www.exploit-db.com/exploits/51732

View Code ZIP pw:eip

References (4)

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/51732

[Product] https://www.tinycontrol.pl

[Third Party Advisory] https://www.vulncheck.com/advisories/tinycontrol-lan-controller-a-authentication-bypass-via-admin-password-change

[Exploit, Third Party Advisory] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5787.php

Scores

CVSS v3 9.8

EPSS 0.0170

EPSS Percentile 82.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-862

Status published

Products (1)

tinycontrol/lan_controller_firmware < 1.58a

Published Dec 30, 2025

Tracked Since Feb 18, 2026