Tycon Systems TPDIN-Monitor-WEB2

p a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-202-01.json" strong View CSAF /strong /a /p h2 Summary /h2 p strong Successful exploitation of these vulnerabilities could result in an attacker accessing sensitive credentials, disrupting connected infrastructure, or manipulating physical equipment, which could present a physical safety risk. /strong /p p The following versions of Tycon Systems TPDIN-Monitor-WEB2 are affected: /p ul li TPDIN-Monitor-WEB2 2.3.9 nbsp; /li /ul div class="csaf-table" table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap thead tr th role="columnheader" data-tablesaw-priority="persist" CVSS /th th role="columnheader" Vendor /th th role="columnheader" Equipment /th th role="columnheader" Vulnerabilities /th /tr /thead tbody tr td v3 9.8 /td td Tycon Systems /td td Tycon Systems TPDIN-Monitor-WEB2 /td td Authentication Bypass Using an Alternate Path or Channel, Cleartext Storage of Sensitive Information /td /tr /tbody /table /div h3 Background /h3 ul li strong Critical Infrastructure Sectors: /strong Critical Manufacturing /li li strong Countries/Areas Deployed: /strong Worldwide /li li strong Company Headquarters Location: /strong United States /li /ul hr h2 Vulnerabilities /h2 div class="csaf-accordion" p a class="csaf-accordion-toggle-all" href="#" Expand All + /a /p div class="csaf-accordion-item" h3 a class="csaf-accordion-toggle" href="#" CVE-2026-61884 /a /h3 div class="csaf-accordion-content" p The web management interface of the affected device does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, device reboot, remote access service configuration, and network settings, which could allow an attacker to disrupt connected infrastructure or cause physical damage to equipment. /p p a href="https://www.cve.org/CVERecord?id=CVE-2026-61884" View CVE Details /a /p hr h4 Affected Products /h4 h5 Tycon Systems TPDIN-Monitor-WEB2 /h5 div class="ics-vendor-version-status" div class="ics-vendor" strong Vendor: /strong br Tycon Systems /div div class="ics-version" strong Product Version: /strong br Tycon Systems TPDIN-Monitor-WEB2: 2.3.9 /div div class="ics-status" strong Product Status: /strong br known_affected /div /div div class="ics-remediations" h6 Remediations /h6 p strong Vendor fix /strong br Tycon Systems did not respond to CISA's attempts at coordination. Users of Tycon Systems TPDIN-Monitor-WEB2 are encouraged to contact Tycon Systems and keep their systems up to date. br a href="https://www.tyconsystems.com/contact" https://www.tyconsystems.com/contact /a /p /div p strong Relevant CWE: /strong a href="https://cwe.mitre.org/data/definitions/288.html" CWE-288 Authentication