Tycon Systems TPDIN-Monitor-WEB3
CISA reports three flaws (hard-coded credentials, CSRF, missing authorization) in Tycon TPDIN-Monitor-WEB3 <=2.2.9 enabling MitM, credential theft, or device resets.
CISA published ICSA-26-246-08 for Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior, covering CVE-2026-77847 (use of hard-coded credentials, CWE-798), CVE-2026-82712 (CSRF, CWE-352), and CVE-2026-82684 (missing authorization, CWE-862). Exploitation could enable man-in-the-middle attacks, factory resets, credential wiping, or extraction of system credentials, configurations, and flash contents; the CSRF issue scores CVSS 8.8. No public exploitation has been reported; CISA recommends isolating devices from business networks.
- Three CVEs: hard-coded credentials (CVE-2026-77847), CSRF (CVE-2026-82712), missing authorization (CVE-2026-82684)
- CSRF issue scores CVSS 8.8 and permits state-changing operations on devices
- Exploitation can enable MitM, factory reset, credential wipe, or configuration and flash extraction
- Keep devices off the internet and behind firewalls; no exploitation reported
- Vendors
- Tycon Systems
- Products
- TPDIN-Monitor-WEB3
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-82684+2 related CVEs | Missing Authorization Flaw in Tycon Systems TPDIN-Monitor-WEB3 Exposes Credentials | 8.6 group max | <1% |
From the original article
3 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow for an attacker to perform a man-in-the-middle (MitM) attack, cause a factory reset, wipe credentials, or retrieve sensitive information. The following versions of Tycon Systems TPDIN-Monitor-WEB3 are affected: TPDIN-Monitor-WEB3 <=2. 2.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.