Technical impact
The vulnerability allows a user with low privileges on a Tinycontrol device to read the administrator password by accessing a specific resource that is not available through the standard graphical interface. This leak of administrative credentials can lead to privilege escalation and full control over the device, representing a significant confidentiality breach. The weakness is an insecure design flaw classified as CWE-425.
Affected Systems
Affected products are Tinycontrol devices including the tcPDU and LAN Controllers LK3.5, LK3.9, and LK4. The specific firmware versions vulnerable are 1.36 for tcPDU, 1.67 for LK3.5 (hardware versions 3.5–3.8), 1.75 for LK3.9 (hardware version 3.9), and 1.38 for LK4 (hardware version 4.0).
Risk and Exploitability
The CVSS score of 8.6 indicates a high severity impact. The EPSS score is less than 1 %, suggesting that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that a low‑privileged user, either locally on the device or via network access to the management interface, can reach the vulnerable resource. Once the administrator password is accessed, the attacker can compromise the device and potentially affect all connected equipment. As the weakness is limited to privileged users, organizations should evaluate local user permissions and network exposure to mitigate risk.
