Is CVE-2025-15587 actively exploited?

No active exploitation of CVE-2025-15587 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-15587 be exploited remotely?

Partially. CVE-2025-15587 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2025-15587?

CVE-2025-15587 has a CVSS score of 8.6 (HIGH).

HOME VULNERABILITIESCVE-2025-15587

HIGH

CVE-2025-15587

CWE-425Published: March 16, 2026· Updated: Mar 16, 2026

8.6

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:5.0th

Official Description

Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface.

This issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).

NVD Source

Technical Analysis

CVE-2025-15587 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorAdjacent

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X