Tycon Systems TPDIN-Monitor-WEB3: 3 CVEs, High 8.8
Summary
CISA reports 3 vulnerabilities in Tycon Systems TPDIN-Monitor-WEB3. Weakness types: Use of Hard-coded Credentials, Cross-Site Request Forgery (CSRF), Missing Authorization. Successful exploitation of these vulnerabilities could allow for an attacker to perform a man-in-the-middle (MitM) attack, cause a factory reset, wipe credentials, or retrieve sensitive information. Highest CVSS v3 score: 8.8 (High), exploitable over the network.
At a glance
- Vendor
- Tycon Systems
- Products
- TPDIN-Monitor-WEB3
- CVEs
- CVE-2026-77847, CVE-2026-82712, CVE-2026-82684
- Highest CVSS v3
- 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Energy
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-77847 | Use of Hard-coded Credentials | 6.5 | – | No | Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Use of Hard-coded Credential vulnerability. This could allow an attacker to intercept sensitive information or credentials. |
| CVE-2026-82712 | Cross-Site Request Forgery (CSRF) | 8.8 | – | No | Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Cross-Site Request Forgery vulnerability. This could allow an attacker to perform state changing operations on the device. |
| CVE-2026-82684 | Missing Authorization | 8.1 | – | No | Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents. |
Affected products (1)
- Tycon Systems TPDIN-Monitor-WEB3: <=2.2.9
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Tycon Systems has released TPDIN-Monitor-WEB3 Firmware v2.4.2.
- Mitigation: Units already running v2.4.2, for subsequent updates (signed container): https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2.tfw link
- Mitigation: All units currently in the field, including the v2.2.9 covered by this report (legacy Intel HEX): https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2T.hex link
- Mitigation: A unit running v2.2.9 installs the .hex build directly and arrives at v2.4.2 in a single step; no intermediate version is required. The signed .tfw container cannot be read by a v2.2.9 updater, which accepts only Intel HEX, so the .hex artifact is the one every deployed unit needs.
- Mitigation: For more information, contact Tycon Systems https://www.tyconsystems.com/contact link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.