← Advisories

Tinycontrol LAN Controller v3 (LK3) Remote Credentials Extraction PoC

Critical
Advisory ID
ZSL-2023-5786
Release Date
01 September 2023
Vendor
Affected Version
<=1.58a, HW 3.8
CVE
N/A
Tested On
lwIP
Summary

Lan Controller is a very universal device that allows you to connect many different sensors and remotely view their readings and remotely control various types of outputs. It is also possible to combine both functions into an automatic if -> this with a calendar when -> then. The device provides a user interface in the form of a web page. The website presents readings of various types of sensors: temperature, humidity, pressure, voltage, current. It also allows you to configure the device, incl. event setting and controlling up to 10 outputs. Thanks to the support of many protocols, it is possible to operate from smartphones, collect and observ the results on the server, as well as cooperation with other I/O systems based on TCP/IP and Modbus.

Description

An unauthenticated attacker can retrieve the controller's configuration backup file and extract sensitive information that can allow him/her/them to bypass security controls and penetrate the system in its entirety.

Proof of Concept
Disclosure Timeline
18.08.2023Vulnerability discovered.
19.08.2023Vendor contacted.
31.08.2023No response from the vendor.
01.09.2023Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
01.09.2023Initial release
22.09.2023Added reference [1] and [2]
12.10.2023Added reference [3]
14.02.2024Added reference [4]