CVE-2023-7329CWE-306

Tinycontrol LAN Controller v3 (LK3) Remote DoS

High · published November 12, 2025

CVSS v4.0
8.7
EPSS
1%
Percentile
54.3
In the wild
Unconfirmed
What it is

Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore factory settings, leading to a denial of service and configuration loss.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00745 · 54.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-11-12T22:06Z
EPSS history
Timeline
  • 12 NOV 22:06Z
    Tinycontrol LAN Controller v3 (LK3) Remote DoS
    cvelistv5