CVE-2023-53739
Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure
- State
- Published
- Severity
- 9.9 Critical
- Published
- Dec 9, 2025
- Updated
- Jul 28, 2026
- Reserved
- Dec 7, 2025
Description
Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3_settings.bin file and extract base64-encoded user and admin passwords without authentication.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.9 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N | VulnCheck |
Weaknesses
- CWE-260 Password in Configuration File
Affected Products
| Product | Versions |
|---|---|
Tinycontrol LAN Controller vTinycontrol |
|
LKTinycontrol |
|
References
- ExploitDB-51731exploit
- Tinycontrol Product Homepageproduct
- Zero Science Lab Advisory IDvendor-advisory
- VulnCheck Advisory: Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosurethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.