An unauthenticated authentication bypass vulnerability in Tinycontrol LAN Controller allows remote attackers to reset administrative passwords and gain full control of the device.

This flaw, categorized as CWE-862 (Missing Authorization), exists in the /stm.cgi endpoint. An unauthenticated attacker can supply a specially crafted authentication parameter to disable access controls and overwrite the administrative password.

The ability for an unauthorized party to modify administrative credentials provides complete control over the device. Because the LAN Controller is used to manage physical sensors and power outputs, a compromise could result in unauthorized physical system manipulation, data exfiltration, or the disruption of critical operational technology (OT) monitoring. With a CVSS score of 7.5, this high-severity vulnerability poses a significant risk to the integrity and availability of managed environments.

Immediate Action: Update the LAN Controller firmware to the latest version provided by Tinycontrol. If an update is not immediately available, restrict network access to the device to trusted management segments only.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts to the /stm.cgi endpoint. Regularly audit administrative account activity and configuration change logs for anomalous entries.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an internal firewall policy to block external access to the device management interface. Ensure the device is not directly exposed to the public internet.

Public Exploit Available: Yes, a public proof-of-concept script is available via ExploitDB (EDB-ID 51732).

Given the ease of exploitation and the potential for full device takeover, administrators must prioritize securing these controllers immediately. If the device cannot be patched, it must be isolated from all untrusted networks to prevent remote exploitation. Failure to address this vulnerability effectively grants an attacker the ability to manipulate the physical environment managed by the controller.