CVE-2023-54327

CriticalPublic PoC

Published: 30 December 2025

Published

30 December 2025

Modified

16 January 2026

KEV Added

—

Patch

—

CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0062 45.1th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2023-54327 is a critical-severity Missing Authorization (CWE-862) vulnerability in Tinycontrol Lan Controller Firmware. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Deeper analysis

Tinycontrol LAN Controller version 1.58a is affected by CVE-2023-54327, an authentication bypass vulnerability stemming from CWE-862 (Missing Authorization). The flaw enables unauthenticated attackers to submit a specially crafted API request to the /stm.cgi endpoint, using a manipulated authentication parameter to disable access controls and modify administrative credentials, including changing admin passwords. This issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility and high impact on confidentiality, integrity, and availability.

Unauthenticated remote attackers can exploit this vulnerability with low complexity and no user interaction required. By sending the crafted request, they gain the ability to overwrite admin passwords, effectively seizing full administrative control of the device. This could lead to complete compromise of the LAN controller, potentially allowing further network pivoting or disruption of connected systems.

Advisories from VulnCheck and Zero Science Laboratory (ZSL-2023-5787) describe the vulnerability in detail, with a proof-of-concept exploit published on Exploit-DB (EDB-ID: 51732). The vendor's site at tinycontrol.pl is referenced, though specific patch or mitigation instructions are not detailed in available sources. Security practitioners should isolate affected devices and monitor for anomalous /stm.cgi requests until updates are confirmed.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2023-60532

Vulnerability details

Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls and modify…

administrative credentials.

CWE(s): CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1098 Account Manipulation Persistence

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

attack.mitre.org →

Why these techniques?

Unauthenticated exploitation of public-facing /stm.cgi endpoint (T1190) enables bypassing authorization to directly modify administrative credentials (T1098).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0