Tinycontrol LAN Controller Missing Authentication Vulnerability in stm.cgi Endpoint Allowing Remote Denial-of-Service

A missing authentication vulnerability has been identified in Tinycontrol LAN Controller v3 (LK3) firmware versions through 1.58a, hardware v3.8. The vulnerability exists in the stm.cgi endpoint, where a remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore factory settings. This exploitation leads to a denial-of-service condition and loss of configuration.

Impact

Exploitation of this vulnerability causes a remote denial-of-service condition by rebooting the device or resetting it to factory settings, resulting in a loss of configuration.

Reproduction

To reproduce this vulnerability, send a request to the stm.cgi endpoint with the eeprom_reset parameter set to 1 to restore factory settings, or with the lk3restart parameter set to 1 to reboot the controller.