Executive brief
Tinycontrol LAN Controller is an IoT device that monitors sensors and controls remote outputs for industrial and home automation. An unauthenticated attacker can bypass access controls and change administrator passwords through a crafted API request, gaining full control of the device and any connected systems it manages.
Technical details
The vulnerability is an authentication bypass in the /stm.cgi endpoint caused by insecure access control logic. An attacker can craft a specially formed auth parameter (prefixed with "00" followed by base64-encoded credentials) to disable authentication checks and modify admin credentials without valid authorization. The attack requires network access to the device's web interface but no prior authentication; a base64-encoded version of the desired password must be constructed and sent via HTTP GET request. Successful exploitation results in complete administrative compromise of the device. Patches for version 1.58a and earlier are indicated as necessary.
Affected products
- Tinycontrol LAN Controller 1.58a and earlier
Timeline
- 2023-10-09: disclosed
- 2023-08-18: advisory: ZSL-2023-5787 advisory from ZeroScience
- 2025-12-30: other: CVE-2023-54327 published to NVD