CVE-2026-61884
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an installer to set them on first use. On firmware 2.4.4 and earlier, a unit left in this unconfigured state serves the web management interface without requiring any login. An attacker with network access to such a unit can reach full device controls, including power relay management, device reboot, remote access service configuration, and network settings, which could allow disruption of connected infrastructure or physical damage to equipment.
Risk Assessment
Negligence during installation can leave the device completely open to attacks, allowing unauthorized remote power-off or configuration changes, leading to service disruptions and equipment damage.
Recommendation
Immediately configure strong HTTP credentials on every device before connecting to the network, and update firmware to a version newer than 2.4.4 if available.
Other vulnerabilities in Tycon Systems TPDIN-Monitor-WEB2
Original NVD description (English source)
The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an installer to set them on first use. On firmware 2.4.4 and earlier, a unit left in this unconfigured state serves the web management interface without requiring any login. An attacker with network access to such a unit can reach full device controls, including power relay management, device reboot, remote access service configuration, and network settings, which could allow disruption of connected infrastructure or physical damage to equipment.