CVE-2025-15587: Credentials exposure in tinycontrol devices

Severity: high (CVSS 8.6 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-16 · updated 2026-06-17
Weakness: CWE-425

Description

Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface. This issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).

Affected products

tinycontrol Lan Kontroler v3.5: before 1.67 — fixed in 1.67
tinycontrol LK3.9: before 1.75 — fixed in 1.75
tinycontrol LK4: before 1.38 — fixed in 1.38
tinycontrol tcPDU: before 1.36 — fixed in 1.36

How to fix

Upgrade to a fixed version: tinycontrol Lan Kontroler v3.5 1.67; tinycontrol LK3.9 1.75; tinycontrol LK4 1.38; tinycontrol tcPDU 1.36. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-15587 or the next vulnerability affects your stack