Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface. This issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2025-15587 Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a spe… https://www.cve.org/CVERecord?id=CVE-2025-15587
Post summary
The post announces CVE‑2025‑15587, a vulnerability in Tinycontrol devices that lets low‑privileged users read an administrator’s password via direct access.
A new vulnerability with increased severity was disclosed for Tinycontrol Lan Kontroler (CVE-2025-15587) https://vuldb.com/?id.351227
Post summary
A new vulnerability (CVE-2025-15587) in Tinycontrol Lan Kontroler has been disclosed with an increased severity rating, but no PoC, exploitation details, patches, or technical specifics are provided.