CVE-2025-15587: Tinycontrol LAN Controller Info Disclosure

CVE-2025-15587 Overview

CVE-2025-15587 is an Insecure Direct Object Reference (IDOR) vulnerability affecting Tinycontrol devices including tcPDU and LAN Controllers LK3.5, LK3.9, and LK4. This vulnerability allows a low-privileged user to read an administrator's password by directly accessing a specific resource that is inaccessible via the graphical interface. The vulnerability is classified under CWE-425 (Direct Request / Forced Browsing), which occurs when an application fails to properly enforce access controls on resources.

Critical Impact

Low-privileged attackers on adjacent networks can escalate privileges by obtaining administrator credentials, potentially gaining full control over affected Tinycontrol devices.

Affected Products

• Tinycontrol tcPDU (firmware versions prior to 1.36)
• Tinycontrol LAN Controller LK3.5 (hardware versions 3.5, 3.6, 3.7, 3.8 - firmware versions prior to 1.67)
• Tinycontrol LAN Controller LK3.9 (hardware version 3.9 - firmware versions prior to 1.75)
• Tinycontrol LAN Controller LK4 (hardware version 4.0 - firmware versions prior to 1.38)

Discovery Timeline

• 2026-03-16 - CVE-2025-15587 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2025-15587

Vulnerability Analysis

This vulnerability exists due to insufficient access control enforcement on sensitive resources within the Tinycontrol device firmware. The web interface fails to properly restrict access to certain endpoints that contain sensitive credential information. While the graphical user interface does not expose these resources to low-privileged users, direct HTTP requests to specific URLs can bypass these UI-level restrictions.

The root issue stems from the application relying on security through obscurity rather than implementing proper server-side authorization checks. When a low-privileged user directly requests the sensitive resource containing administrator credentials, the server responds with the data without verifying whether the requesting user has appropriate permissions to access it.

This represents a classic Broken Access Control vulnerability pattern where the application assumes that hiding links or menu options from the UI is sufficient protection. However, any attacker who discovers the resource path through reconnaissance, documentation, or traffic analysis can bypass these weak controls.

Root Cause

The vulnerability is caused by missing server-side authorization checks on sensitive configuration endpoints. The Tinycontrol firmware implements access restrictions at the UI layer but fails to enforce these same restrictions at the application/API layer. This allows authenticated users with low privileges to directly request resources containing administrator credentials without proper authorization validation.

Attack Vector

The attack requires adjacent network access, meaning the attacker must be on the same local network as the vulnerable device. The exploitation process involves:

1. An attacker first authenticates to the device with low-privileged credentials
2. The attacker identifies or guesses the URL path to the sensitive resource containing admin credentials
3. By directly requesting this resource (bypassing the graphical interface), the attacker retrieves the administrator password
4. With the administrator credentials, the attacker gains full control over the device

Since no code examples are available from verified sources, the vulnerability mechanism can be understood as a direct request attack where the sensitive resource URL is accessed outside of the intended application workflow. Administrators should review the CERT Poland advisory for additional technical details.

Detection Methods for CVE-2025-15587

Indicators of Compromise

• Unusual HTTP requests from low-privileged user sessions targeting configuration or credential endpoints
• Authentication logs showing low-privileged users accessing administrative resources
• Sequential access patterns attempting to enumerate hidden resources
• Sudden privilege escalation activity where low-privileged accounts perform administrative actions

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and alert on direct access attempts to sensitive configuration endpoints
• Review device access logs for low-privileged users attempting to access resources outside normal UI workflows
• Monitor network traffic for unusual request patterns to Tinycontrol devices from internal network segments
• Audit authentication events for privilege escalation indicators such as admin logins following successful low-privilege sessions

Monitoring Recommendations

• Enable verbose logging on all Tinycontrol devices to capture detailed access information
• Implement network segmentation to isolate IoT and control devices from general user networks
• Deploy network monitoring solutions to detect anomalous traffic patterns to affected devices
• Conduct periodic reviews of user access patterns on affected devices to identify potential exploitation attempts

How to Mitigate CVE-2025-15587

Immediate Actions Required

• Update all affected Tinycontrol devices to the latest firmware versions immediately
• Restrict network access to affected devices using firewall rules until patches are applied
• Review access logs for any signs of credential theft or unauthorized access
• Change all administrator passwords on affected devices as a precaution
• Implement network segmentation to limit exposure of control devices

Patch Information

Tinycontrol has released firmware updates that address this vulnerability:

• tcPDU: Update to firmware version 1.36 or later - Download from TinyControl
• LK3.5 (hardware versions 3.5, 3.6, 3.7, 3.8): Update to firmware version 1.67 or later - Download from TinyControl
• LK3.9 (hardware version 3.9): Update to firmware version 1.75 or later - Download from TinyControl
• LK4 (hardware version 4.0): Update to firmware version 1.38 or later - Download from TinyControl

For additional technical information, refer to the CERT Poland advisory.

Workarounds

• Implement strict network access controls to limit which hosts can communicate with affected devices
• Use a dedicated VLAN for IoT and control devices, restricting access to authorized management systems only
• Disable unused user accounts and enforce the principle of least privilege for all device access
• Deploy a reverse proxy with proper authorization enforcement in front of affected devices if direct patching is delayed

# Example firewall rule to restrict access to Tinycontrol devices
# Allow only specific management hosts to access device web interface
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.101 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP