Vulnerability · Published Dec 9, 2025 · Assigned by VulnCheck
CVE-2023-53739Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure
Critical 9.9
In plain English
A critical-severity security flaw in LK from Tinycontrol. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 4.0)9.9Critical
Exploit odds (30 days)0.6%top 49.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3_settings.bin file and extract base64-encoded user and admin passwords without authentication.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Tinycontrol | Tinycontrol LAN Controller v | <=1.58aHW 3.8 |
| Tinycontrol | LK | <=1.58aHW 3.8 |
Weakness: CWE-260 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
References
- ExploitDB-51731 exploit
- Tinycontrol Product Homepage product
- Zero Science Lab Advisory ID vendor-advisory
- VulnCheck Advisory: Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure third-party-advisory