The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credentials during the login process. (CVE-2026-61884)

CVE-2026-61884 describes a critical authentication bypass vulnerability in the Tycon Systems TPDIN-Monitor-WEB2 web management interface. The interface does not perform server-side validation of login credentials, allowing an attacker to submit empty username and password fields and gain administrative access without authentication. This vulnerability affects device management functions such as power relay control, device reboot, remote access service configuration, and network settings management. The CVSS 3.1 base score is 9.8, reflecting its critical impact with network attack vector, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts. No patch or official remediation is currently documented.

An unauthenticated remote attacker can bypass authentication and gain full administrative control over the affected device. This includes managing power relays, rebooting the device, configuring remote access services, and changing network settings. Such control could disrupt infrastructure operations or cause physical damage to connected equipment, posing a critical risk to availability, integrity, and confidentiality of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device management interface to trusted administrators only and monitor for unauthorized access attempts. Consider isolating the device management interface from untrusted networks to reduce exposure.