🔴 《严重安全漏洞：CVE-2026-61884》

CVSS 评分: 严重（9.3）　　状态: Received　　发布时间: 2026-07-24

漏洞描述

The web management interface of Tycon Systems TPDIN-Monitor-WEB2

 does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, device reboot, remote access service configuration, and network settings, which could allow an attacker to disrupt connected infrastructure or cause physical damage to equipment.

🔍 技术细节

字段 值
CVE ID CVE-2026-61884
CVSS 评分 9.3 🔴
严重程度 严重
CVSS 向量 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE 分类 CWE-288
发布时间 2026-07-24
最后更新 2026-07-24
状态 Received
数据来源 ics-cert@hq.dhs.gov

🔗 参考链接