Tinycontrol devices incorporate two distinct authentication mechanisms—one for the management interface and another for all other server resources. When the latter is disabled, which it is by default, an unauthenticated attacker on the local network can observe the HTTP response from the login page and retrieve a JSON file containing usernames and encoded passwords for both normal and admin users. This flaw permits credential exposure without any privileged access, effectively allowing attackers to acquire full management credentials from any device connected to the same local network.

Affected products include Tinycontrol LAN Controllers LK3.5, LK3.9, LK4 and the tcPDU. Firmware affected versions are 1.36 for the tcPDU, 1.67 for the LK3.5 family (hardware versions 3.5–3.8), 1.75 for the LK3.9 (hardware version 3.9), and 1.38 for the LK4 (hardware version 4.0).

The vulnerability carries a CVSS score of 8.7 and an EPSS score of less than 1%, indicating high severity but low exploitation probability in the wild. The attack vector is local network, with the attacker needing physical or network access to the device. Because the exploit is simple—just a request to the login page—an attacker can obtain credentials quickly, leading to potential compromise of device management interfaces and any services governed by those credentials. While the vulnerability is not listed in KEV, the potential for credential theft remains significant for operators who have not applied the corrective firmware or enabled the recommended authentication safeguard.