CVE-2026-61884

Deferred Deferred - Pending Action

Tycon Systems TPDIN-Monitor-WEB2 Authentication Bypass

Publication date: 2026-07-24

Last updated on: 2026-09-04

Assigner: ICS-CERT

Description

The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an installer to set them on first use. On firmware 2.4.4 and earlier, a unit left in this unconfigured state serves the web management interface without requiring any login. An attacker with network access to such a unit can reach full device controls, including power relay management, device reboot, remote access service configuration, and network settings, which could allow disruption of connected infrastructure or physical damage to equipment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-09-04

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-61884

EUVD

EUVD-2026-48745

Affected Vendors & Products

Vendor	Product	Version / Range
tycon_systems	tpdin-monitor-web2	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

The vulnerability in Tycon Systems TPDIN-Monitor-WEB2 allows unauthenticated remote attackers to bypass login authentication by submitting empty credential fields. This grants full administrative access to the device, enabling control over power relays, device reboots, remote access services, and network settings.

Detection Guidance

To detect this vulnerability, check if the Tycon Systems TPDIN-Monitor-WEB2 web interface allows login with empty credentials. Test by submitting blank username and password fields in the login form. If access is granted, the system is vulnerable.

Impact Analysis

An attacker could exploit this to disrupt connected infrastructure or cause physical damage to equipment by manipulating power relays, rebooting devices, or altering network configurations. The high CVSS score indicates severe potential impact.

Compliance Impact

This vulnerability allows unauthenticated attackers to gain full administrative access to the device, potentially exposing sensitive data or disrupting critical operations. This could violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by enabling unauthorized access to systems handling personal or protected health information.

Mitigation Strategies

Immediately update the Tycon Systems TPDIN-Monitor-WEB2 firmware to the latest version provided by the vendor. Disable remote access to the web interface if not required. Implement network segmentation to isolate the device from critical systems.

Hi! I’m here to help you understand CVE-2026-61884. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70