CVE-2026-61884 is a critical authentication bypass vulnerability (CWE-288) in Tycon Systems TPDIN-Monitor-WEB2 version 2.3.9. The vulnerability arises because the web management interface fails to perform server-side validation of login credentials. An unauthenticated remote attacker can submit empty username and password fields to bypass authentication and establish an administrative session. This unauthorized access allows full control over device management features, including power relay control, device reboot, remote access service configuration, and network settings, posing significant risks to operational infrastructure and physical equipment.

Successful exploitation grants an unauthenticated attacker full administrative access to the affected device, enabling control over critical functions such as power relays, device reboot, remote access, and network configuration. This can lead to disruption of connected infrastructure operations or physical damage to equipment, representing a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted administrators only and monitor for unauthorized access attempts. Avoid exposing the management interface to untrusted networks.