Paper/Archive/CVE-2023-53739

CVE-2023-53739

Tinycontrol Tinycontrol LAN Controller v — Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure

EPSS 0.6%public exploit CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 50.3.503 × 2010.1 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3_settings.bin file and extract base64-encoded user and admin passwords without authentication.

Affected

ProductAffectedFixed inSource

Tinycontrol LAN Controller v<=1.58a–CNA

Tinycontrol LAN Controller vHW 3.8–CNA

LK<=1.58a–CNA

LKHW 3.8–CNA

Scores by source

VulnCheck (CNA)9.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/51731 reftinycontrol.pl advisoryzeroscience.mk/en/vulnerabilities/ZSL-2023-5786.php writeupvulncheck.com/advisories/tinycontrol-lan-controller-v3-lk3-unauthenticated-configuration-backup-disclosure