Tinycontrol devices expose admin credentials by default
Two authentication bypass flaws in Tinycontrol tcPDU and LAN Controllers allow unauthenticated attackers to obtain admin passwords; patches available.
CERT Polska coordinated disclosure of two authentication vulnerabilities affecting Tinycontrol's tcPDU and LAN Controller product lines (LK3.5, LK3.9, and LK4). CVE-2025-11500 stems from a dual authentication mechanism where the default configuration exposes usernames and encoded passwords in a JSON response on the login page when server-wide authentication is disabled. An unauthenticated attacker on the local network can retrieve both normal and admin credentials by simply inspecting HTTP responses.
CVE-2025-15587 allows low-privileged users to escalate to administrator access by directly requesting specific resources not exposed through the graphical interface. The vendor has released firmware updates addressing both issues across all affected product lines. Organizations using these devices should prioritize patching, particularly those relying on default configurations which leave CVE-2025-11500 exploitable out of the box.
Mentioned in this report
Detection guidance
Unauthenticated Retrieval of Credential JSON from Tinycontrol Device Login Page
Detects an HTTP GET to a Tinycontrol tcPDU/LAN Controller login endpoint that returns a JSON response without any authentication header/cookie present, consistent with CVE-2025-11500 credential disclosure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Retrieval of Credential JSON from Tinycontrol Device Login
Page
id: 370aac00-e6cb-5109-8f29-2c37b70ce365
status: experimental
description: Detects HTTP requests to a device login page that return JSON content
containing account/password fields with no Authorization header or session cookie
present, matching the Tinycontrol CVE-2025-11500 default-config credential exposure
pattern.
references:
- CERT Polska advisory on Tinycontrol tcPDU/LAN Controller CVE-2025-11500
author: Vorant
tags:
- attack.t1552.001
- attack.credential-access
logsource:
category: proxy
product: null
detection:
selection:
cs-method: GET
c-uri|contains: login
sc-status: 200
filter_auth:
cs-cookie|contains:
- session
- auth
- token
condition: selection and not filter_auth
falsepositives:
- Legitimate first-time device setup where no session exists yet and login page is
loaded normally
- Monitoring/health-check scripts polling the login endpoint
level: medium
Direct Request to Admin-Only Resource Bypassing Tinycontrol Web UI Navigation
Detects a low-privileged client directly requesting an admin-only resource path on a Tinycontrol device that is not normally reachable through the standard UI navigation flow, consistent with the CVE-2025-15587 privilege escalation technique. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Direct Request to Admin-Only Resource Bypassing Tinycontrol Web UI Navigation
id: ff4664a7-63f2-508c-8470-a280ef327934
status: experimental
description: Detects HTTP requests for administrative resource paths on Tinycontrol
tcPDU/LAN Controller devices where the referrer does not originate from an authenticated
admin session page, indicating direct/forced browsing to privileged endpoints as
described in CVE-2025-15587.
references:
- CERT Polska advisory on Tinycontrol tcPDU/LAN Controller CVE-2025-15587
author: Vorant
tags:
- attack.t1078
- attack.privilege-escalation
- attack.defense-evasion
logsource:
category: proxy
product: null
detection:
selection:
c-uri|contains:
- /admin
- /config
- /settings
sc-status: 200
filter_normal_nav:
cs-referer|contains:
- /admin
- /dashboard
condition: selection and not filter_normal_nav
falsepositives:
- Administrators using bookmarked deep links directly to admin pages
- API integrations or automation scripts that call admin endpoints directly with valid
credentials
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/03/CVE-2025-11500
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free