CISA advisories flag five vulnerabilities across Tycon Systems TPDIN-Monitor-WEB2 and WEB3 remote power monitors

Two CISA advisories dated 2026-09-03 cover five CVEs in Tycon Systems power-monitor products: TPDIN-Monitor-WEB2 firmware below 2.4.5 (CVE-2026-61884, CVSS 9.8, unauthenticated relay/reboot control when HTTP credentials are unset; CVE-2026-55985, CVSS 4.3,…

On 2026-09-03, CISA advisories addressed two Tycon Systems remote power-monitor products. For TPDIN-Monitor-WEB2 (advisory marked Update A), firmware below 2.4.5 is affected by CVE-2026-61884 (CVSS 9.8, CWE-306): on units left without configured HTTP credentials, any network attacker gains unauthenticated access to full device controls, including power relay management, reboots, and network changes, with physical safety risk. CVE-2026-55985 (CVSS 4.3) exposes stored system credentials in cleartext to authenticated dashboard users, potentially enabling compromise of other local systems. For TPDIN-Monitor-WEB3, advisory ICSA-26-246-08 covers versions 2.2.9 and prior with three flaws: CVE-2026-77847 (use of hard-coded credentials, CWE-798), CVE-2026-82712 (CSRF, CWE-352, CVSS 8.8, permitting state-changing operations on devices), and CVE-2026-82684 (missing authorization, CWE-862). Exploitation of the WEB3 flaws could enable man-in-the-middle attacks, factory resets, credential wiping, or extraction of system credentials, configurations, and flash contents. CISA reports no public exploitation for either advisory. Recommended mitigations are updating WEB2 to firmware 2.4.5 or later and restricting its internet exposure, and keeping WEB3 devices off the internet, behind firewalls, and isolated from business networks. The reports do not specify a fixed firmware version for WEB3.