Tycon TPDIN-Monitor-WEB3 vulnerabilities patched
CISA advises three vulnerabilities in Tycon Systems TPDIN-Monitor-WEB3 firmware could let attackers steal credentials, force factory resets, or perform MitM attacks.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory covering three vulnerabilities in Tycon Systems TPDIN-Monitor-WEB3, a device monitoring product used in critical manufacturing and energy sectors worldwide. Affected versions are 2.2.9 and prior. The flaws include hard-coded credentials (CVE-2026-77847) that could allow interception of sensitive information, a cross-site request forgery weakness (CVE-2026-82712) enabling state-changing operations on the device, and a missing authorization issue (CVE-2026-82684) that could allow extraction of system credentials, configurations, or flash contents. Combined, these could enable man-in-the-middle attacks, forced factory resets, credential wiping, or sensitive data disclosure.
Tycon Systems has released Firmware v2.4.2 to remediate the issues, with separate update artifacts depending on whether units are already on v2.4.2 or still running legacy v2.2.9 (which requires a direct Intel HEX update path). CISA states no known public exploitation of these vulnerabilities has been reported at this time, and recommends standard ICS defensive practices such as network segmentation, firewalling control system networks, and using VPNs for remote access. The vulnerabilities were reported to CISA by researcher Abdiwelli Guled.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-08
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs