Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-61884: Tycon Systems TPDIN-Monitor-WEB2 Login Credentials Not Verified
CVE-2026-61884
CVE-2026-61884
Summary
An attacker can bypass login checks and access the device's controls, potentially causing physical damage or disrupting connected equipment. This is a concern for devices that manage power or network settings. Update the device's software to the latest version to address this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| tycon systems | tpdin-monitor-web2 | 2.3.9 |
Original title
The web management interface of Tycon Systems TPDIN-Monitor-WEB2
does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fi...
Original description
The web management interface of Tycon Systems TPDIN-Monitor-WEB2
does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, device reboot, remote access service configuration, and network settings, which could allow an attacker to disrupt connected infrastructure or cause physical damage to equipment.
does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, device reboot, remote access service configuration, and network settings, which could allow an attacker to disrupt connected infrastructure or cause physical damage to equipment.
mitre CVSS3.1
9.8
Vulnerability type
CWE-288
Authentication Bypass Using Alternate Path
Published: 24 Jul 2026 · Updated: 24 Jul 2026 · First seen: 24 Jul 2026