Tinycontrol LAN Controller v3 (LK3) Remote Credentials Extraction PoC
Title: Tinycontrol LAN Controller v3 (LK3) Remote Credentials Extraction PoC
Advisory ID: ZSL-2023-5786
Type: Local/Remote
Impact: Security Bypass, Privilege Escalation, System Access, Exposure of System Information, Exposure of Sensitive Information
Risk: (5/5)
Release Date: 01.09.2023
[19.08.2023] Vendor contacted.
[31.08.2023] No response from the vendor.
[01.09.2023] Public security advisory released.
[2] https://cxsecurity.com/issue/WLB-2023090014
[3] https://www.exploit-db.com/exploits/51731
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/275811
[22.09.2023] - Added reference [1] and [2]
[12.10.2023] - Added reference [3]
[14.02.2024] - Added reference [4]
Web: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2023-5786
Type: Local/Remote
Impact: Security Bypass, Privilege Escalation, System Access, Exposure of System Information, Exposure of Sensitive Information
Risk: (5/5)
Release Date: 01.09.2023
Summary
Lan Controller is a very universal device that allows you to connect many different sensors and remotely view their readings and remotely control various types of outputs. It is also possible to combine both functions into an automatic if -> this with a calendar when -> then. The device provides a user interface in the form of a web page. The website presents readings of various types of sensors: temperature, humidity, pressure, voltage, current. It also allows you to configure the device, incl. event setting and controlling up to 10 outputs. Thanks to the support of many protocols, it is possible to operate from smartphones, collect and observ the results on the server, as well as cooperation with other I/O systems based on TCP/IP and Modbus.Description
An unauthenticated attacker can retrieve the controller's configuration backup file and extract sensitive information that can allow him/her/them to bypass security controls and penetrate the system in its entirety.Vendor
Tinycontrol - https://www.tinycontrol.plAffected Version
<=1.58a, HW 3.8Tested On
lwIPVendor Status
[18.08.2023] Vulnerability discovered.[19.08.2023] Vendor contacted.
[31.08.2023] No response from the vendor.
[01.09.2023] Public security advisory released.
PoC
lk3_backup.pyCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] https://packetstormsecurity.com/files/174456/[2] https://cxsecurity.com/issue/WLB-2023090014
[3] https://www.exploit-db.com/exploits/51731
[4] https://exchange.xforce.ibmcloud.com/vulnerabilities/275811
Changelog
[01.09.2023] - Initial release[22.09.2023] - Added reference [1] and [2]
[12.10.2023] - Added reference [3]
[14.02.2024] - Added reference [4]
Contact
Zero Science LabWeb: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk
