# Empty Credentials, Full Control: Two Flaws in a Power Monitor Give Attackers Physical Access to Industrial Sites
## The Threat
A power distribution monitor used in critical manufacturing environments ships with two compounding vulnerabilities that, taken together, hand an unauthenticated attacker complete administrative control over connected electrical infrastructure — and Tycon Systems never responded when CISA came knocking.
The device at the center of this is the TPDIN-Monitor-WEB2, a DIN-rail-mounted web-managed power monitor common in industrial and commercial panel installations. Its management interface contains a login bypass so blunt it defies belief: submitting empty strings for both the username and password fields passes authentication and establishes a valid admin session. No credentials. No token. No challenge. Just blank fields and a submit button.
Once inside, an attacker gains direct control over the device's power relay management, reboot functions, remote access service configuration, and network settings. These aren't abstract software controls — they toggle physical outputs. Disrupting power to connected equipment or manipulating relay states in an industrial context can mean damaged machinery, data loss, or, in sufficiently sensitive environments, personnel risk. The second vulnerability makes a bad situation worse: the management dashboard stores and displays system credentials in cleartext on a configuration page, meaning anyone who can reach the panel after auth bypass can immediately harvest credentials for lateral movement deeper into the network.
## Severity and Impact
| CVE | CWE | CVSS v3.1 Score | Severity | CVSS v4.0 Score | Vector String (v3.1) |
|---|---|---|---|---|---|
| CVE-2026-61884 | CWE-288 (Auth Bypass via Alternate Path) | 9.8 | CRITICAL | 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVE-2026-55985 | CWE-312 (Cleartext Storage of Sensitive Info) | 4.3 | MEDIUM | 5.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
CVE-2026-61884 requires no authentication, no user interaction, and no special conditions — network reachability alone is sufficient. The attack complexity is low in the truest sense: the bypass mechanism is submitting an empty login form. CVE-2026-55985 is secondary but clinically important; it transforms the authentication bypass into a full credential harvest.
## Affected Products
No other versions were evaluated. The vendor did not participate in the disclosure process.
## Mitigations
Tycon Systems did not respond to CISA's coordination attempts and has not issued a patch. There is no vendor-supplied fix available. Operators must rely entirely on network-level controls until a firmware update materializes — if it ever does.
Immediate actions:
## References
---
## HackWire Analysis
The empty-credentials bypass in CVE-2026-61884 is not a sophisticated zero-day — it's a missing server-side validation check that any code review should have caught before firmware ever shipped. That's the detail that deserves attention here. Authentication bypasses of this category (CWE-288) appear when developers build login logic that checks credentials client-side, or implement server-side checks that can be short-circuited by submitting unexpected input like null or empty values. In 2026, this class of bug in an internet-connected device that controls physical power outputs is not a QA failure — it's a product liability question.
What compounds the risk is the vendor's silence. CISA logged failed coordination attempts, meaning there is no patch, no timeline, and no acknowledgment. Organizations operating this hardware are now on their own indefinitely. That is not unusual in the industrial device market — smaller hardware vendors routinely have no dedicated security response function — but it underscores why procurement decisions need to include vendor security posture, not just feature specs and price.
The physical-consequence angle is underreported in early coverage. A power monitor with relay management isn't a passive sensor — it actuates. In data center UPS configurations, building management systems, or manufacturing floor panel boards, unauthorized relay toggling can cause unexpected shutdowns, equipment damage, or in edge cases, create conditions that trip physical safety systems. Defenders in critical manufacturing sectors specifically named in this advisory should treat exposed instances as a physical plant risk, not merely a network intrusion vector.
For any organization running ICS equipment, this advisory is also a prompt to audit what else is sitting on routeable network segments with default or trivially bypassed credentials. This device is almost certainly not alone.
— HackWire Editorial
---
## Related Coverage