EUVD-2025-208690Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Direct request prevention
|
| Impact | Despite the high CVSS 4.0 score of 8.6, the real-world risk requires nuanced assessment. The attack vector is Adjacent Network (AV:A), limiting exploitation to attackers on the same network segment, and requires low privileges (PR:L) with no user interaction. The high impact ratings (VC:H/VI:H/VA:H) reflect the severity of exposing administrator credentials. However, the absence from CISA KEV indicates no known active exploitation, and no public POC exists. The SSVC framework would likely rate this as 'Attend' rather than 'Act' priority due to limited exploitation evidence and network-adjacent requirements. Organizations should prioritize patching based on network exposure and criticality of managed infrastructure rather than CVSS score alone. |
| Exploit ScenarioDerived | An attacker with valid low-privilege credentials on the same network segment as the Tinycontrol device could bypass the web interface restrictions by directly crafting HTTP requests to hidden administrative endpoints. By accessing these unprotected resources, they could retrieve the administrator password in plaintext or easily reversible format, then use these credentials to gain full control over the power distribution unit or LAN controller, potentially disrupting critical infrastructure operations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
A privilege escalation vulnerability in Tinycontrol network management devices (tcPDU and LAN Controllers) allows low-privileged users to retrieve administrator passwords by directly accessing resources that are hidden from the graphical interface. The vulnerability affects multiple product lines including tcPDU, LK3.5, LK3.9, and LK4 controllers across various hardware versions, with a high CVSS score of 8.6 indicating significant risk. No evidence of active exploitation exists (not in KEV), no public POC is available, and the EPSS score is not provided, but patches are available for all affected versions.
RemediationAI
Upgrade affected Tinycontrol devices to the patched firmware versions: tcPDU to version 1.36 or later, LK3.5 series to version 1.67 or later, LK3.9 to version 1.75 or later, and LK4 to version 1.38 or later. Until patching is complete, implement network segmentation to restrict access to management interfaces to trusted administrative networks only, enforce strong authentication for all users, and monitor access logs for suspicious direct resource access attempts. Consider placing these devices behind a secure management VLAN with strict firewall rules limiting access to authorized administrators only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects Tinycontrol's network-connected power distribution units (tcPDU) and LAN Controllers (LK series), which are industrial control devices used for remote power and equipment management. The root cause is CWE-425 (Direct Request or 'Forced Browsing'), a security misconfiguration where sensitive resources lack proper access controls when accessed directly via URLs or API endpoints, even though they appear protected in the user interface. This allows authenticated users with low privileges to bypass intended access restrictions by crafting direct requests to administrative resources that store or expose password data.
Know when Tcpdu gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface.
This issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).
Executive ViewAI
CVE-2025-15587 is a privilege escalation vulnerability in Tinycontrol network management devices (tcPDU and LAN Controllers) that enables low-privileged users to extract administrator credentials, potentially compromising administrative access to critical network infrastructure. Organizations running affected tcPDU, LK3.5, LK3.9, or LK4 controllers should prioritize remediation, as successful exploitation could grant attackers full administrative control over network management and connected devices.
Apply vendor patch. If immediate patching is not feasible, implement network segmentation to restrict low-privileged user access to affected devices, enforce strong access controls limiting local login capabilities, and monitor administrative account activity for unauthorized access attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB