Tpdin Monitor Web2 CVE-2026-61884

Q: What is the CVSS score of CVE-2026-61884?

CVE-2026-61884 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-48745 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-07-24 icscert

GHSA-jmfc-m78f-w5vj

Authentication Bypass Tpdin Monitor Web2 Tycon Systems

9.3

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (icscert) · only source for this CVE.

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 11:38 vuln.today

CVSS changed

Jul 24, 2026 - 22:23 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

CVE Published

Jul 24, 2026 - 21:40 cve.org

CRITICAL 9.3

DescriptionCVE.org

The web management interface of Tycon Systems TPDIN-Monitor-WEB2

does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, device reboot, remote access service configuration, and network settings, which could allow an attacker to disrupt connected infrastructure or cause physical damage to equipment.

AnalysisAI

Remote authentication bypass in Tycon Systems TPDIN-Monitor-WEB2 allows unauthenticated attackers to gain full administrative access by submitting empty credentials. This enables control of power relays, device reboot, and network configuration, potentially causing physical equipment damage. No active exploitation or public exploit has been reported at this time.