PT-2026-64420 · Tycon Systems · Tpdin-Monitor-Web2

CVE-2026-61884 · Publicado 2026-07-24 · Atualizado 2026-07-24

NVD

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The web management interface of Tycon Systems TPDIN-Monitor-WEB2

 does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, device reboot, remote access service configuration, and network settings, which could allow an attacker to disrupt connected infrastructure or cause physical damage to equipment.

Correção

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2026-61884

Produtos afetados

Tpdin-Monitor-Web2

Referências · 4

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-202-01.json · Nota
• https://tyconsystems.com/contact · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-61884 · Nota de Segurança
• https://cisa.gov/news-events/ics-advisories/icsa-26-202-01 · Nota