The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page… (CVE-2026-55985)

CVE-2026-55985 describes a vulnerability in the Tycon Systems TPDIN-Monitor-WEB2 device where the web management interface stores and displays system credentials in cleartext on a configuration page accessible to authenticated users. This cleartext exposure (CWE-312) means that any party with administrative dashboard access can immediately read sensitive credentials, which may facilitate lateral movement or compromise of other local network systems. The vulnerability requires low privileges (authenticated user) and has no user interaction needed. The CVSS vector indicates network attack vector, low attack complexity, and limited confidentiality impact.

The impact is limited confidentiality exposure of system credentials to authenticated users of the administrative interface. This could lead to unauthorized access to other systems on the local network if the credentials are reused or provide further access. There is no impact on integrity or availability reported. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the administrative dashboard to trusted personnel only and consider changing exposed credentials regularly. Avoid reusing credentials across systems to limit potential lateral compromise.