An information disclosure vulnerability (CWE-200) exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpoint fails to enforce authentication, permitting remote attackers to issue crafted POST requests that retrieve sensitive configuration data such as plaintext administrative credentials. Exploitation of this flaw can result in full compromise of the system, enabling unauthorized manipulation of connected devices and aquarium parameters. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity. No patch or official remediation has been provided as of the publication date.

Exploitation allows remote, unauthenticated attackers to access sensitive configuration data including plaintext administrative credentials. This can lead to full compromise of the Aquatronica Controller System, enabling unauthorized control and manipulation of connected aquarium devices and parameters.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected devices, especially to the tcp.php endpoint, to trusted users only. Monitor for unusual activity and consider isolating vulnerable systems from untrusted networks.