Exploitation Summary
EIP tracks 1 public exploit for CVE-2023-7329. PoCs published by LiquidWorm.
AI-analyzed exploit summary This exploit demonstrates an unauthenticated remote denial of service (DoS) vulnerability in Tinycontrol LAN Controller v3 (LK3) 1.58a. It allows an attacker to reboot or reset the device to factory settings by sending direct requests to the stm.cgi endpoint.
Description
Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore factory settings, leading to a denial of service and configuration loss.
Exploits (1)
This exploit demonstrates an unauthenticated remote denial of service (DoS) vulnerability in Tinycontrol LAN Controller v3 (LK3) 1.58a. It allows an attacker to reboot or reset the device to factory settings by sending direct requests to the stm.cgi endpoint.
References (6)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N