CVE-2023-54327 Tinycontrol LAN Controller 1.58a Authentication Bypass via Admin Password Change
Unauthenticated attackers can bypass authentication to change admin passwords on Tinycontrol LAN Controllers via a crafted API request.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-54327?
CVE-2023-54327 is a critical authentication bypass vulnerability in Tinycontrol LAN Controller, published on 30 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls and modify administrative credentials.
Weakness: CWE-862
Which versions are affected by CVE-2023-54327?
It affects 1 product.
Products include Tinycontrol Lan Controller Firmware.
How do I fix CVE-2023-54327?
No fix has been published for CVE-2023-54327 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-54327 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-54327 exists.
Sources
Also known as GHSA-hcw3-qjrp-gq57.