An unauthenticated authentication bypass vulnerability in the Tycon Systems TPDIN-Monitor-WEB2 web interface allows full administrative control over power and network settings.

This vulnerability stems from a lack of server-side credential validation (CWE-288) during the login process. By submitting empty values, an attacker can bypass authentication entirely and establish an administrative session, granting them unrestricted control over the device.

The CVSS score of 9.8 reflects the extreme risk posed by this vulnerability, as it allows for trivial, unauthenticated remote control of critical infrastructure. An attacker could remotely reboot equipment, modify network settings, or disable power relays, potentially causing physical damage or operational outages in the environments where these devices are deployed.

Immediate Action: Contact Tycon Systems for the latest security updates and apply them immediately. In the absence of a direct patch, consider isolating the device management interface from all external networks.

Proactive Monitoring: Review web access logs for unusual login patterns or multiple requests with empty credentials, which may indicate an attempt to exploit this flaw.

Compensating Controls: Deploy a Web Application Firewall (WAF) or place the device behind a secure VPN to prevent direct access to the management interface by unauthorized entities.

Public Exploit Available: Unknown

Due to the critical severity and the ease of exploitation, this device should be removed from public-facing networks immediately. Ensure that the device management interface is only accessible via trusted internal networks until a formal firmware update is applied.