[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-tycon-fixes-critical-no-login-flaw-in-power-distribution-units":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},6049,"tycon-fixes-critical-no-login-flaw-in-power-distribution-units","Tycon Fixes Critical No-Login Flaw in Power Distribution Units","Firmware 2.4.5 fixes a bug letting anyone on the network control power relays without a password, and a cleartext-credential flaw.","Tycon Systems just patched a power distribution unit that let a stranger on the network flip your relays with zero login required.\n\nCISA revised its advisory for the Tycon Systems TPDIN-Monitor-WEB2, a networked power distribution unit deployed in critical manufacturing settings worldwide, on September 3, 2026. The core issue: units running firmware 2.4.4 or earlier ship with no HTTP credentials configured, meant to be set by an installer on first use. Skip that step, and the web management interface serves full device control - power relay switching, reboot, remote access settings, network configuration - to anyone who can reach it over the network, no login needed. CISA scores that flaw 9.8 out of 10, close to the top of the CVSS scale. A second, milder bug, rated 4.3, stores system credentials in cleartext on a configuration page, letting anyone with basic dashboard access read passwords that might work elsewhere on the network. Firmware 2.4.5 fixes both: it now requires an admin password before serving the interface, and it strips the exposed credentials from the page.\n\nThis isn't an edge case for security researchers to argue about. These units sit in critical manufacturing environments and control physical power relays. Skip the setup wizard, or factory-reset a device without redoing it, and the box is open to anyone on the network - no phishing, no exploit chain, just a browser and an IP address.\n\nCISA says it has no evidence of active exploitation so far, but an unauthenticated web console on an industrial power controller has been the setup for enough prior ICS advisories that \"not yet\" is doing a lot of work in that sentence.","[\"ics-security\",\"cisa-advisory\",\"critical-infrastructure\",\"vulnerability\"]","2026-09-03T12:00:00.000Z","2026-09-03T16:44:33.526Z","2026-09-03T16:44:45.448Z","published",null,[],"security",[26,27,28,29],"ics-security","cisa-advisory","critical-infrastructure","vulnerability",[31],{"name":32,"url":33},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-202-01",0,{"sections":36},[37,42,46,51,56,61,66,71,76,81,86,91,96,101],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",3385,"2026-09-04T22:17:36.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":45},"Security",565,"2026-09-05T00:03:08.000Z",{"name":47,"slug":48,"count":49,"latest_published_at":50},"Policy","policy",300,"2026-09-04T22:18:34.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Hardware","hardware",152,"2026-09-03T09:26:48.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Consumer Tech","consumer-tech",97,"2026-09-04T15:29:18.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Science","science",96,"2026-09-03T22:30:00.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Software","software",73,"2026-08-18T07:51:50.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Startups","startups",54,"2026-09-04T23:36:14.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"General","general",37,"2026-09-04T20:22:41.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]