CVE-2026-61884
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credentials during login. Submitting empty values for both credential fields allows an unauthenticated remote attacker to bypass authentication and establish a valid administrative session.
Risk Assessment
An attacker gains full access to device controls including power relay management, reboot, remote access configuration, and network settings, potentially disrupting connected infrastructure or causing physical damage.
Recommendation
Update Tycon Systems TPDIN-Monitor-WEB2 firmware to the latest version containing the fix.
Original NVD description (English source)
The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, device reboot, remote access service configuration, and network settings, which could allow an attacker to disrupt connected infrastructure or cause physical damage to equipment.