CVE-2023-54327
Published: 30 December 2025
Description
Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls and modify…
more
administrative credentials.
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to system resources, directly preventing unauthenticated bypass of controls on the /stm.cgi endpoint.
Restricts actions performable without identification or authentication, blocking unauthenticated admin password modifications.
Validates information inputs at API endpoints to block specially crafted authentication parameters that disable access controls.
Security SummaryAI
Tinycontrol LAN Controller version 1.58a is affected by CVE-2023-54327, an authentication bypass vulnerability stemming from CWE-862 (Missing Authorization). The flaw enables unauthenticated attackers to submit a specially crafted API request to the /stm.cgi endpoint, using a manipulated authentication parameter to disable access controls and modify administrative credentials, including changing admin passwords. This issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility and high impact on confidentiality, integrity, and availability.
Unauthenticated remote attackers can exploit this vulnerability with low complexity and no user interaction required. By sending the crafted request, they gain the ability to overwrite admin passwords, effectively seizing full administrative control of the device. This could lead to complete compromise of the LAN controller, potentially allowing further network pivoting or disruption of connected systems.
Advisories from VulnCheck and Zero Science Laboratory (ZSL-2023-5787) describe the vulnerability in detail, with a proof-of-concept exploit published on Exploit-DB (EDB-ID: 51732). The vendor's site at tinycontrol.pl is referenced, though specific patch or mitigation instructions are not detailed in available sources. Security practitioners should isolate affected devices and monitor for anomalous /stm.cgi requests until updates are confirmed.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated exploitation of public-facing /stm.cgi endpoint (T1190) enables bypassing authorization to directly modify administrative credentials (T1098).