CVE-2023-54327

Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls and modify administrative credentials.

An unauthenticated attacker can take administrative control of the device by changing admin passwords and disabling access controls.

Update the device software to a patched version or, if unavailable, isolate the device from public networks and restrict access to the management interface.