CVE-2023-53739CWE-260

Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure

Critical · published December 9, 2025

CVSS v4.0
9.9
EPSS
1%
Percentile
49.6
In the wild
Unconfirmed
What it is

Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3_settings.bin file and extract base64-encoded user and admin passwords without authentication.

The record
Technical detail
CVSS v4.0
9.9 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS
0.00632 · 49.6th percentile
Weakness
CWE-260 · Password in Configuration File
Published
2025-12-09T20:49Z
EPSS history
Timeline
  • 09 DEC 20:49Z
    Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure
    cvelistv5