CVE-2025-11500

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11500", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2025-10-08T14:14:53.731Z", "datePublished": "2026-03-16T09:26:14.290Z", "dateUpdated": "2026-03-16T16:24:33.361Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Lan Kontroler v3.5", "vendor": "tinycontrol", "versions": [{"lessThan": "1.67", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "LK3.9", "vendor": "tinycontrol", "versions": [{"lessThan": "1.75", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "LK4", "vendor": "tinycontrol", "versions": [{"lessThan": "1.38", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "tcPDU", "vendor": "tinycontrol", "versions": [{"lessThan": "1.36", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Pawe\u0142 R\u00f3\u017ca\u0144ski (Securitum.com)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Tinycontrol devices such as <span style=\"background-color: rgb(255, 255, 255);\">tcPDU and&nbsp;</span>LAN Controllers LK3.5, LK3.9 and LK4&nbsp;have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources. When the latter is turned off (which is a default setting), an unauthenticated attacker on the local network can obtain usernames and encoded passwords for interface management portal by inspecting the HTTP response of the server when visiting the login page, which contains a JSON file with these details. Both normal and admin users credentials are exposed.&nbsp;<br><span style=\"background-color: rgb(255, 255, 255);\">This issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and&nbsp;1.38 (for LK4 - hardware version 4.0).</span><br>"}], "value": "Tinycontrol devices such as tcPDU and\u00a0LAN Controllers LK3.5, LK3.9 and LK4\u00a0have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources. When the latter is turned off (which is a default setting), an unauthenticated attacker on the local network can obtain usernames and encoded passwords for interface management portal by inspecting the HTTP response of the server when visiting the login page, which contains a JSON file with these details. Both normal and admin users credentials are exposed.\u00a0\nThis issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and\u00a01.38 (for LK4 - hardware version 4.0)."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-261", "description": "CWE-261 Weak Encoding for Password", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-03-16T09:26:14.290Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://cert.pl/en/posts/2026/03/CVE-2025-11500/"}, {"tags": ["technical-description"], "url": "https://securitum.com/CVE-2025-11500"}, {"tags": ["release-notes"], "url": "https://tinycontrol.pl/en/archives/lan-controller-35/downloads/#firmware"}, {"tags": ["release-notes"], "url": "https://tinycontrol.pl/en/lk39/downloads/#firmware"}, {"tags": ["release-notes"], "url": "https://tinycontrol.pl/en/lk4/downloads/#firmware"}, {"tags": ["release-notes"], "url": "https://tinycontrol.pl/en/tcpdu/downloads/#firmware"}], "source": {"discovery": "EXTERNAL"}, "title": "Credentials exposure in tinycontrol devices", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Enabling \"Basic Authentication\" option mitigates the risk, because an attacker has to log in first prior to exploitation.&nbsp;"}], "value": "Enabling \"Basic Authentication\" option mitigates the risk, because an attacker has to log in first prior to exploitation."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T16:24:05.827486Z", "id": "CVE-2025-11500", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T16:24:33.361Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11500", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T16:24:05.827486Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T16:24:25.544Z"}}], "cna": {"title": "Credentials exposure in tinycontrol devices", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Pawe\u0142 R\u00f3\u017ca\u0144ski (Securitum.com)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "tinycontrol", "product": "Lan Kontroler v3.5", "versions": [{"status": "affected", "version": "0", "lessThan": "1.67", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "tinycontrol", "product": "LK3.9", "versions": [{"status": "affected", "version": "0", "lessThan": "1.75", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "tinycontrol", "product": "LK4", "versions": [{"status": "affected", "version": "0", "lessThan": "1.38", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "tinycontrol", "product": "tcPDU", "versions": [{"status": "affected", "version": "0", "lessThan": "1.36", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.pl/en/posts/2026/03/CVE-2025-11500/", "tags": ["third-party-advisory"]}, {"url": "https://securitum.com/CVE-2025-11500", "tags": ["technical-description"]}, {"url": "https://tinycontrol.pl/en/archives/lan-controller-35/downloads/#firmware", "tags": ["release-notes"]}, {"url": "https://tinycontrol.pl/en/lk39/downloads/#firmware", "tags": ["release-notes"]}, {"url": "https://tinycontrol.pl/en/lk4/downloads/#firmware", "tags": ["release-notes"]}, {"url": "https://tinycontrol.pl/en/tcpdu/downloads/#firmware", "tags": ["release-notes"]}], "workarounds": [{"lang": "en", "value": "Enabling \"Basic Authentication\" option mitigates the risk, because an attacker has to log in first prior to exploitation.", "supportingMedia": [{"type": "text/html", "value": "Enabling \"Basic Authentication\" option mitigates the risk, because an attacker has to log in first prior to exploitation.&nbsp;", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Tinycontrol devices such as tcPDU and\u00a0LAN Controllers LK3.5, LK3.9 and LK4\u00a0have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources. When the latter is turned off (which is a default setting), an unauthenticated attacker on the local network can obtain usernames and encoded passwords for interface management portal by inspecting the HTTP response of the server when visiting the login page, which contains a JSON file with these details. Both normal and admin users credentials are exposed.\u00a0\nThis issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and\u00a01.38 (for LK4 - hardware version 4.0).", "supportingMedia": [{"type": "text/html", "value": "Tinycontrol devices such as <span style=\"background-color: rgb(255, 255, 255);\">tcPDU and&nbsp;</span>LAN Controllers LK3.5, LK3.9 and LK4&nbsp;have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources. When the latter is turned off (which is a default setting), an unauthenticated attacker on the local network can obtain usernames and encoded passwords for interface management portal by inspecting the HTTP response of the server when visiting the login page, which contains a JSON file with these details. Both normal and admin users credentials are exposed.&nbsp;<br><span style=\"background-color: rgb(255, 255, 255);\">This issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and&nbsp;1.38 (for LK4 - hardware version 4.0).</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-261", "description": "CWE-261 Weak Encoding for Password"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-03-16T09:26:14.290Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11500", "state": "PUBLISHED", "dateUpdated": "2026-03-16T16:24:33.361Z", "dateReserved": "2025-10-08T14:14:53.731Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-03-16T09:26:14.290Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Lan Kontroler v3.5", "vendor": "tinycontrol", "versions": [{"lessThan": "1.67", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "LK3.9", "vendor": "tinycontrol", "versions": [{"lessThan": "1.75", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "LK4", "vendor": "tinycontrol", "versions": [{"lessThan": "1.38", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "tcPDU", "vendor": "tinycontrol", "versions": [{"lessThan": "1.36", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tinycontrol devices such as tcPDU and\u00a0LAN Controllers LK3.5, LK3.9 and LK4\u00a0have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources. When the latter is turned off (which is a default setting), an unauthenticated attacker on the local network can obtain usernames and encoded passwords for interface management portal by inspecting the HTTP response of the server when visiting the login page, which contains a JSON file with these details. Both normal and admin users credentials are exposed.\u00a0\nThis issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and\u00a01.38 (for LK4 - hardware version 4.0)."}, {"lang": "es", "value": "Los dispositivos Tinycontrol como tcPDU y los controladores LAN LK3.5, LK3.9 y LK4 tienen dos mecanismos de autenticaci\u00f3n separados: uno \u00fanicamente para la gesti\u00f3n de la interfaz y otro para proteger todos los dem\u00e1s recursos del servidor. Cuando este \u00faltimo est\u00e1 desactivado (lo cual es una configuraci\u00f3n predeterminada), un atacante no autenticado en la red local puede obtener nombres de usuario y contrase\u00f1as codificadas para el portal de gesti\u00f3n de la interfaz al inspeccionar la respuesta HTTP del servidor cuando se visita la p\u00e1gina de inicio de sesi\u00f3n, la cual contiene un archivo JSON con estos detalles. Las credenciales de usuarios normales y administradores quedan expuestas.\nEste problema ha sido solucionado en las versiones de firmware: 1.36 (para tcPDU), 1.67 (para LK3.5 - versiones de hardware: 3.5, 3.6, 3.7 y 3.8), 1.75 (para LK3.9 - versi\u00f3n de hardware 3.9) y 1.38 (para LK4 - versi\u00f3n de hardware 4.0)."}], "id": "CVE-2025-11500", "lastModified": "2026-06-17T08:30:35.007", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11500", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T16:24:05.827486Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:17:54.113", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2026/03/CVE-2025-11500/"}, {"source": "cvd@cert.pl", "url": "https://securitum.com/CVE-2025-11500"}, {"source": "cvd@cert.pl", "url": "https://tinycontrol.pl/en/archives/lan-controller-35/downloads/#firmware"}, {"source": "cvd@cert.pl", "url": "https://tinycontrol.pl/en/lk39/downloads/#firmware"}, {"source": "cvd@cert.pl", "url": "https://tinycontrol.pl/en/lk4/downloads/#firmware"}, {"source": "cvd@cert.pl", "url": "https://tinycontrol.pl/en/tcpdu/downloads/#firmware"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}, {"lang": "en", "value": "CWE-261"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.67)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Lan Kontroler v3.5", "source": "cna", "vendor": "tinycontrol"}, "product": "lan_controller", "vendor": "tinycontrol"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.75)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "LK3.9", "source": "cna", "vendor": "tinycontrol"}, "product": "lk3.9", "vendor": "tinycontrol"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.38)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "LK4", "source": "cna", "vendor": "tinycontrol"}, "product": "lk4", "vendor": "tinycontrol"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.36)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "tcPDU", "source": "cna", "vendor": "tinycontrol"}, "product": "tcpdu", "vendor": "tinycontrol"}], "analysis": {"en": {"generated_at": "2026-03-21T14:35:36.670753+00:00", "value": {"mitigation_remediation": ["Apply the latest firmware updates for each affected Tinycontrol product (tcPDU 1.36, LK3.5 1.67, LK3.9 1.75, LK4 1.38).", "Enable the Basic Authentication option to require login before any credential data is exposed; this is the official workaround offered by Tinycontrol."], "summary": {"action": "Immediate Patch", "impact": "Credentials exposed to local network"}, "threat_synthesis": {"affected_systems": "Affected products include Tinycontrol LAN Controllers LK3.5, LK3.9, LK4 and the tcPDU. Firmware affected versions are 1.36 for the tcPDU, 1.67 for the LK3.5 family (hardware versions 3.5\u20133.8), 1.75 for the LK3.9 (hardware version 3.9), and 1.38 for the LK4 (hardware version 4.0).", "description_and_impact": "Tinycontrol devices incorporate two distinct authentication mechanisms\u2014one for the management interface and another for all other server resources. When the latter is disabled, which it is by default, an unauthenticated attacker on the local network can observe the HTTP response from the login page and retrieve a JSON file containing usernames and encoded passwords for both normal and admin users. This flaw permits credential exposure without any privileged access, effectively allowing attackers to acquire full management credentials from any device connected to the same local network.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 8.7 and an EPSS score of less than 1%, indicating high severity but low exploitation probability in the wild. The attack vector is local network, with the attacker needing physical or network access to the device. Because the exploit is simple\u2014just a request to the login page\u2014an attacker can obtain credentials quickly, leading to potential compromise of device management interfaces and any services governed by those credentials. While the vulnerability is not listed in KEV, the potential for credential theft remains significant for operators who have not applied the corrective firmware or enabled the recommended authentication safeguard."}}}}, "created": "2026-03-24T10:45:15.466137+00:00", "updated": "2026-03-30T08:00:33.704792+00:00", "vendors": ["tinycontrol", "tinycontrol$PRODUCT$lan_controller", "tinycontrol$PRODUCT$lk3.9", "tinycontrol$PRODUCT$lk4", "tinycontrol$PRODUCT$tcpdu"]}