How severe is CVE-2023-53739?

CVE-2023-53739 has a CVSS 4.0 base score of 9.9, rated critical severity.

Is CVE-2023-53739 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2023-53739?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2023-53739 have an EU (EUVD) identifier?

Yes. CVE-2023-53739 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-60177.

When was CVE-2023-53739 published?

CVE-2023-53739 was published on 2025-12-09 and last updated on 2026-06-17.

CVE-2023-53739

CVE-2023-53739 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-260.

Key facts

Severity: Critical (CVSS 4.0 base score 9.9)
EPSS exploit prediction: 1% (43rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2023-60177
Weakness: CWE-260
Published: 2025-12-09
Last modified: 2026-06-17

Description

Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3_settings.bin file and extract base64-encoded user and admin passwords without authentication.

Frequently asked questions

What is CVE-2023-53739?: Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3_settings.bin file and extract base64-encoded user and admin passwords without authentication.
How severe is CVE-2023-53739?: CVE-2023-53739 has a CVSS 4.0 base score of 9.9, rated critical severity.
Is CVE-2023-53739 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2023-53739?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2023-53739 have an EU (EUVD) identifier?: Yes. CVE-2023-53739 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-60177.
When was CVE-2023-53739 published?: CVE-2023-53739 was published on 2025-12-09 and last updated on 2026-06-17.

References

Other CWE-260 vulnerabilities

CVE-2025-57754 — Critical (CVSS 9.8): eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is…
CVE-2025-25022 — Critical (CVSS 9.6): IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could…
CVE-2025-6513 — Critical (CVSS 9.3): Standard Windows users can access the configuration file for database access of the BRAIN2 application and decrypt it.
CVE-2025-32111 — High (CVSS 8.7): The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks…
CVE-2019-25465 — High (CVSS 7.5): Hisilicon HiIpcam V100R003 contains a directory traversal vulnerability that allows unauthenticated attackers to access…
CVE-2023-53770 — High (CVSS 7.5): MiniDVBLinux 5.4 contains an unauthenticated configuration download vulnerability that allows remote attackers to…

Browse all CWE-260 vulnerabilities →