CVE-2025-11500: Tinycontrol Credential Disclosure Flaw

CVE-2025-11500 Overview

CVE-2025-11500 is a sensitive data exposure vulnerability affecting Tinycontrol devices including tcPDU and LAN Controllers (LK3.5, LK3.9, and LK4). The vulnerability exists due to insecure default configurations in the device's dual authentication mechanism. When the secondary authentication protecting server resources is disabled (the default setting), an unauthenticated attacker on the local network can obtain usernames and encoded passwords by simply inspecting HTTP responses from the login page, which contains a JSON file exposing these credentials for both normal and administrator users.

Critical Impact

Unauthenticated attackers on the local network can harvest credentials for all user accounts including administrators, potentially leading to complete device compromise and unauthorized control of power distribution units and industrial LAN controllers.

Affected Products

• Tinycontrol tcPDU (firmware versions prior to 1.36)
• Tinycontrol LK3.5 LAN Controller (hardware versions 3.5, 3.6, 3.7, 3.8 - firmware prior to 1.67)
• Tinycontrol LK3.9 LAN Controller (hardware version 3.9 - firmware prior to 1.75)
• Tinycontrol LK4 LAN Controller (hardware version 4.0 - firmware prior to 1.38)

Discovery Timeline

• 2026-03-16 - CVE-2025-11500 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2025-11500

Vulnerability Analysis

This vulnerability stems from CWE-201 (Insertion of Sensitive Information Into Sent Data), a category of information disclosure flaws where sensitive data is inadvertently included in communications. The Tinycontrol devices implement two separate authentication mechanisms: one dedicated to interface management and another designed to protect all other server resources. The critical design flaw is that the secondary authentication mechanism is disabled by default, creating an exposed attack surface.

When the secondary authentication is turned off, the device's web server includes a JSON data structure containing usernames and encoded passwords directly within the HTTP response served on the login page. This means any unauthenticated user with network adjacency to the device can simply browse to the login page and inspect the response to extract credentials for all configured accounts, including administrative users.

Root Cause

The root cause of CVE-2025-11500 is an insecure default configuration combined with improper handling of sensitive credential data. The firmware includes authentication credentials in the HTTP response payload regardless of the authentication state, failing to implement proper access controls before transmitting sensitive user data. This represents a fundamental violation of the principle of least privilege and secure-by-default design practices.

Attack Vector

The attack requires adjacent network access, meaning the attacker must be on the same local network segment as the vulnerable device. The exploitation process is straightforward:

1. The attacker identifies a Tinycontrol device on the local network
2. The attacker navigates to the device's login page via HTTP
3. The attacker inspects the HTTP response (via browser developer tools or packet capture)
4. The JSON payload containing usernames and encoded passwords is extracted
5. The attacker decodes or cracks the passwords to gain administrative access

This vulnerability requires no user interaction and can be exploited with minimal technical knowledge. Once credentials are obtained, an attacker gains full control over the device, which could include power distribution units capable of disrupting critical infrastructure or LAN controllers managing network operations.

Detection Methods for CVE-2025-11500

Indicators of Compromise

• Unusual HTTP requests to Tinycontrol device login pages from unknown internal IP addresses
• Multiple rapid requests to the login endpoint without subsequent authenticated sessions
• Network reconnaissance activity targeting Tinycontrol device ports
• Unexpected administrative actions or configuration changes on Tinycontrol devices

Detection Strategies

• Monitor network traffic for HTTP responses from Tinycontrol devices containing JSON structures with credential-related fields
• Implement network segmentation monitoring to detect unauthorized access attempts to industrial control network segments
• Deploy intrusion detection rules to identify scanning activity targeting known Tinycontrol device signatures
• Review authentication logs on Tinycontrol devices for successful logins from unexpected sources following reconnaissance patterns

Monitoring Recommendations

• Enable verbose logging on Tinycontrol devices and forward logs to a centralized SIEM platform
• Establish baseline network traffic patterns for Tinycontrol devices and alert on anomalies
• Implement network access controls and monitor for policy violations
• Conduct regular firmware version audits to identify unpatched devices

How to Mitigate CVE-2025-11500

Immediate Actions Required

• Update all Tinycontrol tcPDU devices to firmware version 1.36 or later
• Update LK3.5 LAN Controllers (hardware versions 3.5, 3.6, 3.7, 3.8) to firmware version 1.67 or later
• Update LK3.9 LAN Controllers (hardware version 3.9) to firmware version 1.75 or later
• Update LK4 LAN Controllers (hardware version 4.0) to firmware version 1.38 or later
• Enable the secondary authentication mechanism if patching is not immediately possible

Patch Information

Tinycontrol has released firmware updates that address this vulnerability. The patched firmware versions are:

• tcPDU: version 1.36 - available from TinyControl tcPDU Firmware Download
• LK3.5: version 1.67 - available from TinyControl LAN Controller 35 Firmware
• LK3.9: version 1.75 - available from TinyControl LK39 Firmware Download
• LK4: version 1.38 - available from TinyControl LK4 Firmware Download

For additional technical analysis, refer to the CERT CVE-2025-11500 Analysis and Securitum CVE-2025-11500 Overview.

Workarounds

• Enable the secondary authentication mechanism on affected devices to prevent unauthenticated access to credential data
• Isolate Tinycontrol devices on dedicated network segments with strict access controls
• Implement firewall rules to restrict access to device management interfaces to authorized administrative workstations only
• Change all user and administrator passwords after applying mitigations, as previous credentials may have been compromised

# Network isolation example using iptables
# Restrict access to Tinycontrol device management interface (adjust IP addresses as needed)
iptables -A FORWARD -d 192.168.1.100 -p tcp --dport 80 -s 192.168.1.50 -j ACCEPT
iptables -A FORWARD -d 192.168.1.100 -p tcp --dport 80 -j DROP