{"id":"CVE-2025-15587","aliases":["EUVD-2025-208690","GHSA-p5qr-79pr-g4vp"],"status":"published","title":"Credentials exposure in tinycontrol devices","description":"Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface.\n\nThis issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00175,"percentile":0.06983,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-425"],"published":"2026-03-16T09:26:00Z","modified":"2026-06-17T08:38:05Z","products":[{"vendor":"tinycontrol","product":"lan kontroler v3.5"},{"vendor":"tinycontrol","product":"lk3.9"},{"vendor":"tinycontrol","product":"lk4"},{"vendor":"tinycontrol","product":"tcpdu"}],"references":[{"url":"https://cert.pl/en/posts/2026/03/CVE-2025-11500/","tags":["third-party-advisory"]},{"url":"https://tinycontrol.pl/en/archives/lan-controller-35/downloads/#firmware","tags":["release-notes"]},{"url":"https://tinycontrol.pl/en/lk39/downloads/#firmware","tags":["release-notes"]},{"url":"https://tinycontrol.pl/en/lk4/downloads/#firmware","tags":["release-notes"]},{"url":"https://tinycontrol.pl/en/tcpdu/downloads/#firmware","tags":["release-notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15587"},{"url":"https://cert.pl/en/posts/2026/03/CVE-2025-11500"},{"url":"https://github.com/advisories/GHSA-p5qr-79pr-g4vp"}],"sources":{"cve":[{"id":"CVE-2025-15587","title":"Credentials exposure in tinycontrol devices","description":"Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface.\n\nThis issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).","status":"published","published":"2026-03-16T09:26:00.418Z","modified":"2026-03-16T16:26:18.674Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T14:32:37.351404Z"}],"euvd":[{"id":"EUVD-2025-208690","description":"Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface.\n\nThis issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).","status":"published","published":"2026-03-16T09:26:00Z","modified":"2026-03-16T16:26:18Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:25:34.078511Z"}],"ghsa":[{"id":"GHSA-p5qr-79pr-g4vp","title":"Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged...","description":"Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface.\n\nThis issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).","status":"published","published":"2026-03-16T15:30:41Z","modified":"2026-03-16T15:30:53Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T15:06:38.778049Z"}],"nvd":[{"id":"CVE-2025-15587","description":"Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface.\n\nThis issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).","status":"published","published":"2026-03-16T14:17:56.577Z","modified":"2026-06-17T08:38:05.083Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T14:12:01.641503Z"}]}}