# Two authentication bypass vulnerabilities in Tinycontrol tcPDU and LAN Controllers allow…

Published: 2026-03-16 · Severity: high
Canonical: https://vorant.io/reports/1aff8586-b0b4-4b4a-a098-ee537a16f663/two-authentication-bypass-vulnerabilities-in-tinycontrol-tcpdu-and-lan

> Two authentication bypass vulnerabilities in Tinycontrol tcPDU and LAN Controllers allow credential theft; patches available in firmware versions 1.36-1.75.

CERT Polska disclosed two vulnerabilities affecting Tinycontrol devices including tcPDU and LAN Controllers (LK3.5, LK3.9, LK4). CVE-2025-11500 exposes a critical authentication bypass where usernames and encoded passwords are leaked in JSON responses when visiting the login page, due to a separate authentication mechanism for interface management that defaults to off. This allows unauthenticated attackers on the local network to obtain both normal and admin credentials. CVE-2025-15587 is a privilege escalation issue allowing low-privileged users to read administrator passwords by directly accessing specific resources not available through the graphical interface.

Both vulnerabilities have been patched in recent firmware releases: version 1.36 for tcPDU, version 1.67 for LK3.5 (hardware 3.5-3.8), version 1.75 for LK3.9 (hardware 3.9), and version 1.38 for LK4 (hardware 4.0). Organizations using these devices should immediately upgrade to the patched firmware versions. CVE-2025-11500 was reported by Paweł Różański from Securitum, while CVE-2025-15587 was reported by the vendor itself.

These vulnerabilities pose significant risk to organizations using Tinycontrol devices for power distribution and LAN control, as they could allow attackers to gain administrative access to critical infrastructure components.

## Mentioned in this report

- Vulnerabilities: CVE-2025-11500, CVE-2025-15587

## Detection guidance (public sample)

### Unauthenticated Access to Device Login Endpoint Preceding Credential Disclosure

ATT&CK: T1552.001

Detects unauthenticated GET requests to a device login page that returns JSON content, matching the Tinycontrol pattern where visiting the login endpoint leaks usernames and encoded passwords via a separate management API left enabled by default. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unauthenticated GET to Device Login Endpoint Returning JSON Credentials
id: e3c70a6a-7929-53d5-b430-6e6577b3e679
status: experimental
description: 'Detects HTTP GET requests to a device login/authentication endpoint
  where the response is JSON-formatted, consistent with Tinycontrol tcPDU/LAN Controller
  devices exposing usernames and encoded passwords via an interface-management API
  that is enabled by default and not gated by the normal login flow (CVE-2025-11500).
  Intended for proxy/webserver logs monitoring embedded device management interfaces.

  '
logsource:
  category: proxy
detection:
  selection:
    cs-method: GET
    c-uri|contains:
    - /login
  json_response:
    cs-mime-type|contains: json
  filter_authenticated:
    cs-cookie|contains:
    - session
    - auth
  condition: selection and json_response and not filter_authenticated
falsepositives:
- Legitimate initial page load by an administrator before authenticating, if the device
  normally returns JSON metadata on the login page
- Monitoring or uptime-check tools polling the login page as part of health checks
level: high
tags:
- attack.t1552.001
- attack.credential_access
author: Vorant
```

### Direct Access to Administrative Resource Bypassing Web GUI Navigation

ATT&CK: T1078

Detects direct HTTP requests to administrative or password-related resource paths on an embedded device management interface without a referring GUI page, consistent with the Tinycontrol privilege-escalation flaw allowing low-privileged users to fetch admin credentials via resources not reachable through the normal interface (CVE-2025-15587). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Direct Request to Admin Credential Resource Without GUI Referer
id: 057d57eb-cb62-548a-b390-b3024648fc30
status: experimental
description: 'Detects HTTP requests to resource paths containing administrative or
  password-related keywords that lack a Referer header pointing to the device''s own
  web GUI pages, indicating the resource was accessed directly rather than navigated
  to through the interface. This matches the Tinycontrol privilege escalation issue
  where low-privileged users could read administrator passwords by directly requesting
  specific resources not exposed in the GUI (CVE-2025-15587).

  '
logsource:
  category: proxy
detection:
  selection:
    cs-method: GET
    c-uri|contains:
    - admin
    - password
    - pass
  filter:
    c-referer|contains:
    - /index
    - /menu
    - /login
  condition: selection and not filter
falsepositives:
- Legitimate administrator bookmarking or deep-linking directly to an admin settings
  page
- API integrations or scripts that legitimately query configuration endpoints programmatically
level: medium
tags:
- attack.t1078
- attack.privilege_escalation
- attack.initial_access
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/03/CVE-2025-11500

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1aff8586-b0b4-4b4a-a098-ee537a16f663/two-authentication-bypass-vulnerabilities-in-tinycontrol-tcpdu-and-lan.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup