Vulnerability · Published Nov 12, 2025 · Assigned by VulnCheck
CVE-2023-7329Tinycontrol LAN Controller v3 (LK3) Remote DoS
High 8.7
In plain English
A high-severity missing authentication in Lan Controller from tinycontrol. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.7%top 45.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore factory settings, leading to a denial of service and configuration loss.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tinycontrol | Lan Controller | 0 – through 1.58a |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5785.php technical-description, exploit
- https://packetstormsecurity.com/files/174455/ exploit
- https://www.exploit-db.com/exploits/51730 exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/275810 vdb-entry
- https://tinycontrol.pl/en/archives/lan-controller-35/ product
- https://www.vulncheck.com/advisories/tinycontrol-lan-controller-v3-remote-dos third-party-advisory