The web management interface of Tycon Systems TPDIN-Monitor-WEB2  does not perform server-side validation…

CVE-2026-61884 is a textbook authentication-bypass-by-alternate-path (CWE-288) in the Tycon Systems TPDIN-Monitor-WEB2 web management interface, confirmed in firmware 2.3.9 and — per CISA's ICSA-26-202-01 — every prior build. Submit the login form with empty username and empty password and the server hands back a valid administrative session cookie. The dashboard exposes power-relay toggles, device reboot, remote-access service configuration, network settings, and — as a bonus second bug — cleartext display of stored system credentials that can pivot to adjacent gear.

The vendor CVSS of 9.8 is technically correct for the primitive (network, no auth, no UI, full CIA impact) but flatters the real-world picture. Two facts collapse the gap: (1) this is niche OT/telecom hardware — PoE-injected DIN-rail monitors deployed at cell sites, solar arrays, and remote radio huts, not internet-facing enterprise infrastructure, and (2) Tycon has discontinued the product and refused to engage CISA — there will be no patch, ever. That flips the analysis from 'fix it fast' to 'get it off the network permanently.' We assess HIGH because the blast radius on the small population that *is* exposed is physical/operational (cutting power to a remote radio, damaging a battery bank), but the affected population itself is a rounding error on any enterprise fleet.

Why this verdict

• Trivial exploitability, zero prerequisites: unauth remote, no user interaction, exploit is a single curl one-liner. Nothing about the vuln layer justifies a downgrade.
• Installed-base narrowing (-1.0): niche discontinued PoE-injected DIN-rail monitor. Public scanner population is in the hundreds, not the millions — most enterprise fleets have zero units.
• Deployment-position narrowing (-0.5): the majority of remaining units live behind cellular APNs, site VPNs, or NAT with no inbound rules. Public exposure is a subset of an already small base.
• Role multiplier — the device IS the high-value role (+0.3): unlike a typical LOB app, this thing controls physical relays feeding radios, cameras, and battery chargers. Chain outcome on a compromised unit is loss of service or equipment damage at a remote site, not just data theft. That floors the verdict at HIGH and prevents further downgrade.
• Role multiplier — no supply-chain or fleet amplification: compromise of one TPDIN-Monitor-WEB2 does not pivot to a domain, hypervisor, IdP, or CI pipeline. Blast radius is bounded at the site level, which is why the floor is HIGH and not CRITICAL.
• No-patch-ever status: because Tycon has EOL'd the product, this is not a patch-cycle problem — it is a decommission-or-isolate problem. Treat as permanent risk debt for anyone who owns one.

Why not higher?

Not CRITICAL because the installed-base share is a rounding error on any enterprise fleet and the blast radius does not amplify beyond the single site the device controls. There is no domain, tenant, hypervisor, or supply-chain pivot — the ceiling on damage is 'one remote hut goes dark.'

Why not lower?

Not MEDIUM because the exploit is a two-line curl, requires no auth, needs no user interaction, and — for the units that ARE publicly reachable — ends in physical control of power relays. There is also no patch coming, so the risk does not decay over time the way a normal MEDIUM would.

1. Inventory every TPDIN-Monitor-WEB2 you own — today — Search asset DBs, procurement records, and site drawings for Tycon Systems SKUs TPDIN-MONITOR-WEB2 and TPDIN2. Also run a Nmap HTTP-title sweep across site management VLANs for TPDIN. HIGH verdict → noisgate mitigation SLA is 30 days, but for a no-patch-ever OT device you want inventory closed in the first 72 hours so the isolation work can start.
2. Remove all public exposure immediately — Block inbound HTTP/HTTPS to every identified device at the site firewall, cellular router ACL, or upstream edge. There is no legitimate reason for this management interface to sit on a public IP. Verify with an external Nmap or Censys re-check.
3. Force management access through a jump host with MFA — Put the devices on an isolated management VLAN reachable only through a bastion/SASE tunnel that enforces MFA. The device itself cannot be MFA-enabled, so the auth must be enforced upstream.
4. Rotate every credential stored on the device — The companion cleartext-storage bug means any SMTP/SNMP/remote-access credentials that were ever pasted into the UI must be considered burned. Rotate them and stop reusing operational credentials on management gear.
5. Plan decommission/replacement inside 12 months — Vendor is EOL and unresponsive. This is now permanent risk debt — schedule replacement with a supported OT monitoring platform. HIGH verdict maps to a noisgate remediation SLA of 180 days; because there is no vendor patch to apply, treat that 180-day window as your hard deadline to complete network isolation, and treat 12 months as the outer bound for physical replacement.

Run from an auditor workstation with network reachability to the target device (site LAN, jump host, or authorized VPN). Invoke as ./check_tpdin.sh 10.20.30.40 where the argument is the device IP or hostname. Requires only curl and network access — no credentials, no root.

#!/usr/bin/env bash
# noisgate verification for CVE-2026-61884
# Tycon Systems TPDIN-Monitor-WEB2 auth-bypass check
# Usage: ./check_tpdin.sh <host-or-ip> [port]
set -u

HOST="${1:-}"
PORT="${2:-80}"

if [[ -z "$HOST" ]]; then
  echo "Usage: $0 <host-or-ip> [port]" >&2
  exit 2
fi

BASE="http://${HOST}:${PORT}"
CJAR="$(mktemp)"
trap 'rm -f "$CJAR"' EXIT

# 1) Confirm the device is a TPDIN-Monitor-WEB2 by banner/title
TITLE=$(curl -s --max-time 5 "$BASE/" | grep -oiE '<title>[^<]*</title>' | head -n1)
if ! echo "$TITLE" | grep -qi 'TPDIN'; then
  echo "UNKNOWN - host at $BASE does not appear to be a TPDIN-Monitor-WEB2 (title: $TITLE)"
  exit 3
fi

# 2) Attempt the empty-credential bypass. The exact login path varies by
#    firmware build; try the two documented endpoints.
for PATH_ in "/login.cgi" "/cgi-bin/login"; do
  CODE=$(curl -s -o /dev/null -w '%{http_code}' \
    -c "$CJAR" --max-time 5 \
    -X POST --data 'username=&password=' \
    "${BASE}${PATH_}" || true)

  # Any 2xx/3xx that also sets a session cookie is a positive.
  if [[ "$CODE" =~ ^(200|301|302|303)$ ]] && grep -qiE 'session|sid|auth' "$CJAR"; then
    echo "VULNERABLE - empty credentials to ${PATH_} returned $CODE and issued a session cookie"
    exit 1
  fi
done

echo "PATCHED - device did not accept empty credentials on any known login path (note: no vendor patch exists; result may reflect a non-default login handler)"
exit 0

Sources

1. CISA ICSA-26-202-01 — Tycon Systems TPDIN-Monitor-WEB2
2. ISSSource — No Fix for Tycon Systems TPDIN-Monitor-WEB2
3. Assurant Cyber — ICSA-26-202-01 analysis
4. Tycon Systems TPDIN-Monitor-WEB2 product page
5. TPDIN-Monitor-WEB2 firmware downloads
6. TPDIN-Monitor-WEB2 spec sheet (PDF)
7. NCSA Cyber Threat Intelligence 22 July 2026
8. MITRE CWE-288 — Authentication Bypass Using an Alternate Path or Channel