CVE-2026-61884 | The web management interface of Tycon Systems TPDIN-Monitor-… | CVSS 9.8 CRITICAL

Description

The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, device reboot, remote access service configuration, and network settings, which could allow an attacker to disrupt connected infrastructure or cause physical damage to equipment.

Metadata

CVE ID: CVE-2026-61884
State: PUBLISHED
Assigner: icscert
Reserved: 2026-07-13 18:17 UTC
Published: 2026-07-24 21:40 UTC
Last updated: 2026-07-24 21:40 UTC
Primary CWE: CWE-288
CWE-288
Vendor / Product: Tycon Systems / TPDIN-Monitor-WEB2
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
Tycon Systems	TPDIN-Monitor-WEB2	—	2.3.9

Weakness (CWE)

CWE	Source	Description
CWE-288	cna	CWE-288

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (3)