Authentication Flaw in Tinycontrol Devices tcPDU and LK Controllers

CVE-2025-11500

What is CVE-2025-11500?

Tinycontrol devices, including tcPDU and various LK Controllers, are vulnerable due to improper authentication mechanisms. The default setting allows an unauthenticated attacker on the local network to retrieve sensitive information, such as usernames and encoded passwords, by accessing the login page. Specifically, the server's HTTP response reveals a JSON file that contains these credentials. This risk affects both normal and admin accounts, posing a significant security threat if left unaddressed. Upgrading to the indicated firmware versions is crucial for mitigation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References