Log in Start free

Vulnerability · Published Mar 16, 2026 · Assigned by CERT-PL

CVE-2025-15587Credentials exposure in tinycontrol devices

High 8.6

In plain English

A high-severity security flaw in Lan Kontroler v3.5 from tinycontrol. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High
Exploit odds (30 days)0.2%top 93.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface. This issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).

Affected products (as reported)

VendorProductVersions
tinycontrol Lan Kontroler v3.5 0 – before 1.67
tinycontrol LK3.9 0 – before 1.75
tinycontrol LK4 0 – before 1.38
tinycontrol tcPDU 0 – before 1.36

Weakness: CWE-425 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References