tinycontrol Lan Kontroler JSON File Parser weak password encoding

Summaryinfo

A vulnerability labeled as very critical has been found in tinycontrol Lan Kontroler. This impacts an unknown function of the component JSON File Parser. The manipulation results in weak password encoding. This vulnerability was named CVE-2025-11500. The attack needs to be approached within the local network. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as very critical, was found in tinycontrol Lan Kontroler (the affected version unknown). Affected is an unknown part of the component JSON File Parser. The manipulation with an unknown input leads to a weak password encoding vulnerability. CWE is classifying the issue as CWE-261. Obscuring a password with a trivial encoding does not protect the password. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources. When the latter is turned off (which is a default setting), an unauthenticated attacker on the local network can obtain usernames and encoded passwords for interface management portal by inspecting the HTTP response of the server when visiting the login page, which contains a JSON file with these details. Both normal and admin users credentials are exposed.  This issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).

The weakness was presented by Paweł Różański. The advisory is shared for download at cert.pl. This vulnerability is traded as CVE-2025-11500 since 10/08/2025. The exploitability is told to be easy. The attack needs to be done within the local network. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 05/19/2026). The MITRE ATT&CK project declares the attack technique as T1552.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• tinycontrol

Name

• Lan Kontroler

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion