Tpdin Monitor Web2 EUVD-2026-48745

We are asked to produce a JSON analysis for CVE-2026-61884. We need to extract information from the provided data.

First, let's parse the data.

CVE ID: CVE-2026-61884 Description: The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, device reboot, remote access service configuration, and network settings, which could allow an attacker to disrupt connected infrastructure or cause physical damage to equipment.

CVSS Score: 9.3 (this appears to be a CVSS 4.0 base score? The vector is CVSS:4.0 with all base metrics set, but environmental and supplementary all X, so base score would be derived. But 9.3 is likely the base score for that vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Checking: CVSS v4.0 calculator: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N -> base score 9.3 (Critical). So that's the base score provided.

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-288 (Authentication Bypass Using an Alternate Path or Channel)

Multi-source intelligence: EPSS Score: 0.66% (percentile 48%) - so low EPSS, not likely to be widely exploited. Reported by: icscert (CISA ICS advisory) CPE: cpe:2.3:a:tycon_systems:tpdin-monitor-web2:*:*:*:*:*:*:*:* (all versions? No version range given, but affected versions from EUVD says 2.3.9, so maybe all versions? The CPE is without version range, so that's likely the product name without specific version. We'll note that.) Tags: Authentication Bypass, Tpdin Monitor Web2 ENISA EUVD ID: EUVD-2026-48745 Affected versions (EUVD): ["TPDIN-Monitor-WEB2 2.3.9"] - so specifically version 2.3.9, but the CPE has a wildcard version, so it might be all? Possibly only that version is confirmed, but the vulnerability may affect all versions earlier than the fixed one? There's no mention of a patch, so maybe still unpatched? The references include contact form for Tycon Systems, and CISA advisory. Let's check references. No patch information. So remediation is unclear.

References: [cveorg] (None) https://www.tyconsystems.com/contact - just contact page. [cveorg] (None) https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-01 - likely the ICS advisory. [cveorg] (None) https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-202-01.json - CSAF data. [vuldb] (advisory) https://vuldb.com/vuln/383022 [euvd] (advisory) https://nvd.nist.gov/vuln/detail/CVE-2026-61884

Now, analyzing:

The vulnerability: authentication bypass via empty credentials. Product: Tycon Systems TPDIN-Monitor-WEB2. It's an ICS device for power management. Affected version: 2.3.9, but possibly all versions prior? No patch indicated, but advisory likely has mitigation? The CISA advisory might contain mitigations. I'll look up the advisory number: "icsa-26-202-01" - that's a future date? The year 2026-? Probably a placeholder. But we can infer from the description that there's no server-side validation. No specific conditions beyond having the web management interface accessible. So if the interface is exposed to the network, attacker can bypass. Exploitation condition: remote unauthenticated, with default configuration, the web interface is likely intended for local management but accessible over network. Probably default configuration is vulnerable.

Risk assessment: CVSS 9.3 is critical, network, low complexity, no privileges, no user interaction, high impact to confidentiality, integrity, availability. EPSS 0.0066 (0.66%) means low probability of exploitation in the next 30 days, but this could be due to low prevalence. The percentile is 48%, so it's below median. Not in KEV (no indication of active exploitation). So risk: high severity but low exploitation likelihood currently. However, if exposed, the impact is severe (physical damage possible). Remediation: likely no patch; advisory may suggest mitigations like restricting network access, disabling the web interface, etc.

Exploitation conditions: The vulnerability requires the attacker to be able to reach the web management interface. So if the interface is accessible (which might be the default for local network but not internet-exposed, but could be exposed if device is misconfigured), attacker can bypass by sending empty credentials. No authentication required. No special configuration needed; it's a default behavior. So condition: "Web management interface must be network-accessible (default configuration exposes it on the local network; may be exposed remotely if port forwarded)." But the description says "remote attacker", implying it can be exploited over the network. So the condition is the interface is reachable. So "Exploitation requires network access to the device's web management interface, which is enabled by default." No other conditions.

Attack chain: Remote network access -> send login request with empty credentials -> bypass authentication -> gain administrative session -> execute commands to control relays, reboot, etc. So chain: "Send login request with empty username and password -> Server fails to validate credentials -> Session established with admin privileges -> Execute arbitrary administrative actions (power relay control, device reboot, network reconfiguration) -> Cause service disruption or physical damage."

Confidence notes: The vulnerability is reported by CISA ICS advisory (likely confirmed by vendor), but no vendor patch version given. Patch status unknown. The CVE description comes from ICS-CERT, so reliable. EPSS low. No known public exploit code mentioned? Not specified, but the vulnerability is simple, a proof-of-concept would be trivial. But no tag indicates POC, so we'll say "no public exploit identified at time of analysis" unless there's indication otherwise. The vectors from CVSS are provided, so we can use them for risk assessment. The lack of a patch is a concern; workarounds likely in advisory.

Prevalence: The product is a specific ICS device, probably low prevalence. Tycon Systems is a small vendor. The product is a monitor/web controller for power distribution. So prevalence: low. Basis: "specialized industrial power management device".

Now, for the assessed CVSS vectors. The provided CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. That's appropriate. We need to produce our own independent assessment. Since the description confirms network, low complexity, no privileges, no user interaction, and impact to confidentiality (access to configuration), integrity (can change settings), availability (can reboot or disrupt). So I'd keep the same AV:N/AC:L/PR:N/UI:N, Scope Unchanged? The device itself, so scope unchanged. Impact: C:H/I:H/A:H. So CVSS 3.1 vector would be CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That's a 9.8 Critical. But the provided score is 9.3 in CVSS 4.0; 3.1 would be 9.8. However, we are asked to give an assessed CVSS 3.1 vector based on our analysis, not copy the input. So I'll output CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Rationale: "Network-accessible without authentication, no user interaction, full administrative access."

For CVSS 4.0, I'd output the same as provided but with only base metrics (no environmental or supplemental). So: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. That matches.

Now, product_name: "TPDIN-Monitor-WEB2" - 1-3 words. So: "TPDIN-Monitor-WEB2".

Summary: "Authentication bypass in Tycon Systems TPDIN-Monitor-WEB2 allows unauthenticated remote attackers to gain administrative access by submitting empty credentials. The vulnerability affects web management interface version 2.3.9 and potentially prior versions; successful exploitation grants full control over power relay management, device reboot, and network settings, enabling disruption of connected infrastructure. No patch is currently indicated; mitigation requires restricting network access."

But we need to follow instructions: "Explain WHAT the vulnerability is, WHO is affected (specific product/version), and WHAT an attacker can do. Mention if actively exploited (KEV), if POC exists, and EPSS risk if notable." KEV not mentioned, so not actively exploited. EPSS is low (0.66%). So summary: "Authentication bypass in Tycon Systems TPDIN-Monitor-WEB2 web management interface (version 2.3.9) allows remote attackers to gain full administrative access by submitting empty credentials, enabling power relay control and device shutdown. No active exploitation or public exploit code is known; EPSS indicates low probability of exploitation despite critical severity."

Technical context: CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The underlying technology: a web-based management interface, likely running HTTP server on the device, with a login mechanism that fails to check credentials server-side. The CPE indicates the product. "The flaw lies in the server-side login handler that trusts client-supplied credentials; by sending empty strings, the application may compare two empty values and consider them matching, or simply skip authentication. This is typical of improper input validation."

Risk assessment: "CVSS 4.0 base score 9.3 (Critical) with network attack vector, low complexity, no privileges or user interaction, and high impact. EPSS 0.66% (below median) suggests low likelihood of widespread exploitation, likely due to product's niche deployment. No known active exploitation or public exploits identified. However, if the device is exposed to the internet or untrusted networks, the risk is severe due to the potential for physical damage. Prioritize patching and network segmentation."

Affected products: "Tycon Systems TPDIN-Monitor-WEB2 version 2.3.9 is confirmed affected; earlier versions may also be vulnerable. The product is identified by CPE: cpe:2.3:a:tycon_systems:tpdin-monitor-web2:*:*:*:*:*:*:*:*. Vendor advisory available via CISA ICSA-26-202-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-01)."

Remediation: "No vendor-released patch has been identified at time of analysis. Mitigations recommended by CISA include disabling the web management interface if not needed, restricting network access to trusted IPs via firewall rules, and placing the device behind a VPN. The device should never be directly exposed to the internet. Alternative workaround: implement network-level authentication (e.g., HTTP basic auth via reverse proxy)."

Exploit scenario: "A remote attacker scans for exposed TPDIN-Monitor-WEB2 devices on the internet or local network, sends an HTTP POST request with empty username and password fields, and immediately gains admin session. The attacker then toggles power relays to disrupt connected equipment or locks out legitimate administrators."

Exploitation conditions: "Exploitation requires network access to the device's web management interface, which listens on TCP port 80 or 443 by default. No authentication or user interaction is needed; the vulnerability exists in the default configuration. The device must be running firmware version 2.3.9 (or possibly earlier)."

Attack chain: "Scan for exposed TPDIN-Monitor-WEB2 devices → Send HTTP login request with empty credentials → Server fails to validate and grants