CVE-2023-7329: Tinycontrol Lan Controller

High severity, CVSS 8.7. EPSS: 0.9% chance of exploitation in the next 30 days.

Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore factory settings, leading to a denial of service and configuration loss.

Affected products

• Tinycontrol Lan Controller: up to and including 1.58a

Published 2025-11-12. Last modified 2026-06-17.