Critical · published December 31, 2025
🚨 An unauthenticated API request can let attackers change admin passwords! This vulnerability in Tinycontrol LAN Controller 1.58a is like leaving your front door wide open for intruders. 🔥 Think of it as a restaurant where the menu lacks a check for dietary restrictions; any customer can change their meal to something extravagant without the chef’s approval, leading to chaos. In this case, attackers can craft a request that bypasses authentication, just like a diner sneaking into the kitchen. An attacker could waltz right in and take control of the system—modifying admin credentials, locking out legitimate users, and even potentially compromising the entire network. This scenario is absolutely devastating for any organization relying on this controller, as it opens the door to full administrative control.
Think of it as a restaurant where the menu lacks a check for dietary restrictions; any customer can change their meal to something extravagant without the chef’s approval, leading to chaos. In this case, attackers can craft a request that bypasses authentication, just like a diner sneaking into the kitchen. This vulnerability allows unauthenticated attackers to exploit the /stm.cgi endpoint by sending cleverly crafted API requests with modified parameters, disabling essential access controls and granting themselves administrative privileges.
An attacker could waltz right in and take control of the system—modifying admin credentials, locking out legitimate users, and even potentially compromising the entire network. This scenario is absolutely devastating for any organization relying on this controller, as it opens the door to full administrative control. Immediate action is crucial: update Tinycontrol LAN Controller to version 1.58b or later, and ensure that API access is tightly controlled with proper authentication measures. Regularly review your access controls to maintain security. You've got this! Fixing this issue will boost your security game! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| tinycontrol/lan_controller_firmware | ≤ 1.58a | — |