An information disclosure vulnerability in Aquatronica Controller System allows remote attackers to retrieve sensitive configuration data, including plaintext administrative credentials, by accessing the unprotected tcp.php endpoint. The exposed credentials can enable full control over the system, allowing manipulation of connected devices and aquarium parameters.

Aquatronica Controller System firmware versions 5.1.6 and earlier, and web interface versions 2.0 and earlier, are vulnerable. Devices running those versions are at risk until an update is applied.

With a CVSS score of 9.3 and EPSS of 2%, the vulnerability is high severity and considered likely to be exploited. The exploit requires no authentication and can be performed from anywhere with network access to the device, making it a remote attack vector. Since it is not listed in KEV, no known public exploit has been reported to CISA, but the combination of broad accessibility and critical credentials means this flaw could lead to a full compromise of affected systems.