Log in Start free

Vulnerability · Published Mar 16, 2026 · Assigned by CERT-PL

CVE-2025-11500Credentials exposure in tinycontrol devices

High 8.7

In plain English

A high-severity security flaw in Lan Kontroler v3.5 from tinycontrol. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.3%top 73.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources. When the latter is turned off (which is a default setting), an unauthenticated attacker on the local network can obtain usernames and encoded passwords for interface management portal by inspecting the HTTP response of the server when visiting the login page, which contains a JSON file with these details. Both normal and admin users credentials are exposed.  This issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).

Affected products (as reported)

VendorProductVersions
tinycontrol Lan Kontroler v3.5 0 – before 1.67
tinycontrol LK3.9 0 – before 1.75
tinycontrol LK4 0 – before 1.38
tinycontrol tcPDU 0 – before 1.36

Weakness: CWE-261, CWE-201 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References