CVE-2026-61884 is a critical authentication bypass vulnerability (CWE-288) in Tycon Systems TPDIN-Monitor-WEB2 version 2.3.9. The vulnerability arises because the web management interface fails to perform server-side validation of login credentials. An attacker can submit empty username and password fields to bypass authentication and establish an administrative session remotely without any privileges. This unauthorized access allows full control over device management features, including power relay control, device reboot, remote access service configuration, and network settings modification.

Successful exploitation results in full administrative access to the affected device, enabling attackers to manipulate critical device functions. This can lead to disruption of connected infrastructure operations or physical damage to equipment controlled by the device. The vulnerability has a CVSS score of 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is provided, restrict network access to the device's management interface to trusted administrators only and consider isolating the device from untrusted networks to reduce exposure.