CVE-2023-54327
Authentication Bypass in Tinycontrol LAN Controller Allows Admin Password Change
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tinycontrol | lan_controller | 1.58a |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an authentication bypass in Tinycontrol LAN Controller 1.58a. It allows unauthenticated attackers to change admin passwords by sending a specially crafted API request to the /stm.cgi endpoint. The crafted authentication parameter disables access controls, enabling modification of administrative credentials without proper authorization.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can gain unauthorized administrative access by changing admin passwords. This compromises the security of the affected system, potentially allowing the attacker to control the device, access sensitive information, and disrupt normal operations.