CVE-2026-61884: Tycon Systems TPDIN-Monitor-WEB2 Authentication Bypass (CVSS 9.8)

Executive Summary

A critical authentication bypass vulnerability in the Tycon Systems TPDIN-Monitor-WEB2 web management interface allows any unauthenticated remote attacker to gain full administrative access simply by submitting empty username and password fields. No credentials, no exploit code, no user interaction is required — blank values pass the login check and establish a valid admin session.

CVE: CVE-2026-61884 | CVSS v3.1: 9.8 Critical | CVSS v4.0: 9.3 Critical | CWE: CWE-288

CISA issued ICS advisory ICSA-26-202-01 for this vulnerability. No patched firmware version has been released as of July 25, 2026.

Vulnerability Overview

Root Cause

The web management interface of the TPDIN-Monitor-WEB2 performs no server-side validation of login credentials. The login form accepts any input — including empty strings — and the backend grants full administrative access without verifying the submitted values against stored credentials.

Affected Products

The TPDIN-Monitor-WEB2 is an ICS/OT device used for DIN-rail mounted power relay management and remote monitoring of power infrastructure. These devices are commonly deployed in industrial control environments, data centers, and facilities with managed power distribution.

Impact

Once an unauthenticated attacker obtains administrative access through the empty-credential bypass, they can:

• Manipulate power relays — toggle power states for connected equipment
• Reboot devices remotely — force restarts of managed systems
• Modify remote access service configuration — persist access or pivot to other infrastructure
• Change network settings — redirect traffic, alter IP configuration, or isolate devices
• Cause physical disruption — power management control translates directly to physical infrastructure impact

The combination of network-accessible management interface, trivial exploit (empty credentials), and physical-world impact makes this vulnerability particularly dangerous for operators who have exposed these devices to the internet.

Exploitation

The exploit requires:

1. Network access to the TPDIN-Monitor-WEB2 web management interface (typically TCP 80 or 443)
2. Submitting an HTTP POST request to the login endpoint with empty username and password values
3. The device responds with a valid authenticated session

There is no public proof-of-concept code available, but the simplicity of the exploit — empty string submission — means that any attacker who identifies an exposed device can immediately gain admin access without specialized tooling.

Mitigations

No vendor patch is currently available. CISA recommends the following compensating controls:

Immediate Actions

1. Remove from internet exposure immediately — TPDIN-Monitor-WEB2 devices should never be accessible from untrusted networks
2. Restrict network access — Place devices behind a firewall with allowlisted source IPs only
3. Deploy VPN or zero-trust access — Require authenticated VPN access before reaching the management interface
4. Audit current exposure — Scan your network for internet-facing TPDIN-Monitor-WEB2 instances using asset inventory tools or Shodan queries
5. Monitor for unauthorized access — Review web interface access logs for sessions with empty or unusual credential fields

Long-term

• Contact Tycon Systems for firmware patch availability and timeline
• Evaluate replacement if a patch is not forthcoming and operational requirements do not permit isolation

CISA ICS Advisory

CISA issued advisory ICSA-26-202-01 covering this vulnerability. All operators of Tycon Systems TPDIN-Monitor-WEB2 devices should review the advisory and implement the recommended mitigations. The advisory follows CISA's standard recommendation for ICS/OT devices: minimize internet exposure and apply defense-in-depth.

Key Takeaways

1. CVSS 9.8 — Empty credentials bypass authentication entirely; no exploit code needed
2. No patch available — Compensating controls (network isolation, VPN) are the only current mitigation
3. Physical infrastructure at risk — Admin access enables power relay manipulation and potential service disruption
4. CISA ICS advisory issued — ICSA-26-202-01 covers this vulnerability
5. Immediately audit exposure — Any internet-facing TPDIN-Monitor-WEB2 instance is fully compromised if discovered

References

• NVD — CVE-2026-61884
• CISA ICS Advisory ICSA-26-202-01
• Tycon Systems — TPDIN-Monitor-WEB2 Product Page