Description (CNA)
Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3_settings.bin file and extract base64-encoded user and admin passwords without authentication.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Tinycontrol / Tinycontrol LAN Controller v | affected <=1.58a; affected HW 3.8 |
| Tinycontrol / LK | affected <=1.58a; affected HW 3.8 |
CWE
CWE-260
References
- https://www.exploit-db.com/exploits/51731
- https://www.tinycontrol.pl
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5786.php
- https://www.vulncheck.com/advisories/tinycontrol-lan-controller-v3-lk3-unauthenticated-configuration-backup-disclosure
ADP enrichment
No English description supplied.
No references supplied.