An information disclosure vulnerability (CWE-200) affects Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpoint does not restrict unauthenticated access, allowing remote attackers to issue crafted POST requests to retrieve sensitive configuration data, including plaintext administrative credentials. This flaw can lead to full compromise of the system, allowing unauthorized manipulation of connected aquarium devices and parameters. The vulnerability is rated critical with a CVSS 4.0 score of 9.3. No patch or official fix information is currently available, and the product is not a cloud service.

Exploitation of this vulnerability allows remote unauthenticated attackers to obtain sensitive configuration data, including plaintext administrative credentials. This can result in full system compromise, enabling attackers to manipulate connected devices and aquarium parameters without authorization. The critical CVSS score reflects the high impact on confidentiality and system integrity. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should restrict network access to the tcp.php endpoint to trusted users only, implement network-level controls such as firewalls or VPNs to limit exposure, and monitor for unusual access attempts. Stay alert for vendor updates that may provide an official fix.