EUVD-2025-208687Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Strong password encoding
|
| Impact | Despite the high CVSS 4.0 score of 8.7 indicating potential for high impact across confidentiality, integrity, and availability, the real-world exploitation risk appears limited. The CVSS vector shows this requires adjacent network access (AV:A), meaning an attacker must be on the same network segment, significantly reducing the attack surface compared to internet-exposed vulnerabilities. The extremely low EPSS score of 0.00043 (0.043%) suggests minimal observed exploitation activity in the wild. The vulnerability is not listed in CISA's KEV catalog, and no public proof-of-concept code has been identified, further supporting the assessment that while theoretically severe, this vulnerability poses moderate practical risk primarily in scenarios where untrusted users have local network access. |
| Exploit ScenarioDerived | An attacker who gains access to the local network segment where Tinycontrol devices are deployed could simply send an HTTP request to the login page of any vulnerable device without providing credentials. The server's response would contain a JSON file with usernames and encoded passwords for all configured accounts, including administrative users, which the attacker could then decode and use to gain full control over the device's management interface. This attack requires no special tools or authentication and can be automated to harvest credentials from multiple devices quickly. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
An authentication bypass vulnerability in Tinycontrol network devices (tcPDU and LAN Controllers LK3.5, LK3.9, LK4) exposes usernames and encoded passwords for both normal and admin users through unauthenticated HTTP requests to the login page. The vulnerability affects devices running older firmware versions when the secondary authentication mechanism is disabled (default setting), allowing any attacker on the local network to harvest credentials without authentication. With an EPSS score of 0.00043 and no KEV listing, this vulnerability shows low real-world exploitation activity despite its high CVSS score of 8.7.
RemediationAI
Upgrade affected Tinycontrol devices to the following patched firmware versions: tcPDU to version 1.36 or later, LK3.5 controllers to version 1.67 or later, LK3.9 controllers to version 1.75 or later, and LK4 controllers to version 1.38 or later. As an immediate mitigation until patching is complete, enable the secondary authentication mechanism for all server resources if possible, implement network segmentation to restrict access to management interfaces to trusted VLANs only, and monitor for unauthorized access attempts to device login pages. Consider implementing additional network-level access controls such as 802.1X authentication to prevent unauthorized devices from joining the management network.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from inadequate access control on sensitive authentication data (CWE-261), where Tinycontrol devices implement two separate authentication mechanisms - one for interface management and another for protecting server resources. When the secondary authentication is disabled by default, the login page's HTTP response contains a JSON file with usernames and encoded passwords accessible without any authentication. The affected products include Tinycontrol tcPDU power distribution units and LAN Controllers (models LK3.5, LK3.9, and LK4) used for network-based device management and control in industrial and data center environments.
Know when Tcpdu gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources. When the latter is turned off (which is a default setting), an unauthenticated attacker on the local network can obtain usernames and encoded passwords for interface management portal by inspecting the HTTP response of the server when visiting the login page, which contains a JSON file with these details. Both normal and admin users credentials are exposed. This issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).
Executive ViewAI
Tinycontrol network devices (tcPDU and LAN Controllers LK3.5, LK3.9, LK4) expose administrative and user credentials through unauthenticated HTTP requests when secondary authentication is disabled, allowing any local network attacker to harvest plaintext-encoded passwords without authentication. Organizations using affected firmware versions face immediate credential compromise risk that could enable unauthorized device management and lateral network movement.
Apply vendor patch. If patch application is delayed, immediately enable secondary authentication mechanism on all affected devices (non-default configuration). Implement network segmentation to restrict local network access to Tinycontrol devices and rotate all credentials post-patch deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB