The Cybersecurity and Infrastructure Security Agency warned on Sept. 3 that three vulnerabilities in Tycon Systems’ TPDIN-Monitor-WEB3 affect version 2.2.9 and earlier. CISA said successful exploitation could enable an attacker to perform a man-in-the-middle attack, cause a factory reset, wipe credentials, or retrieve sensitive information. The advisory identifies critical manufacturing and energy as sectors where the equipment is deployed and lists deployment in countries and areas worldwide. (CISA)
The most serious issue by CVSS v3.1 scoring is a cross-site request forgery flaw tracked as CVE-2026-82712. It has a CVSS v3.1 score of 8.8, rated high. CISA said the vulnerability could allow an attacker to perform state-changing operations on the device. Cross-site request forgery is listed in the advisory as the relevant weakness category for the issue.
The advisory also lists CVE-2026-82684, a missing-authorization vulnerability with a CVSS v3.1 score of 8.1, also rated high. CISA said exploitation could allow an attacker to extract system credentials, configurations, or flash contents. The listed attack requires low-level privileges, according to the advisory’s scoring information.
The third issue, CVE-2026-77847, involves hard-coded credentials. It carries a CVSS v3.1 score of 6.5, rated medium. CISA said the weakness could allow an attacker to intercept sensitive information or credentials. The advisory identifies use of hard-coded credentials as the relevant weakness category.
CISA said Tycon Systems has released TPDIN-Monitor-WEB3 Firmware v2.4.2 as the vendor fix for the affected vulnerabilities. The agency’s advisory provides separate update files for equipment depending on the firmware version and update method in use. Units already running version 2.4.2 can use a signed .tfw container for subsequent updates. (CISA’s advisory)
For units currently in the field, including those running affected version 2.2.9, CISA identifies a legacy Intel HEX .hex file as the applicable update. The advisory says a unit running version 2.2.9 installs that build directly and reaches version 2.4.2 in a single step, without requiring an intermediate version. It also says the version 2.2.9 updater accepts only Intel HEX and cannot read the signed .tfw container. The advisory provides the firmware links and directs users seeking more information to Tycon Systems.
CISA recommended reducing network exposure for control-system devices and systems and ensuring that they are not accessible from the internet. It advised organizations to place control-system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, the agency recommended more secure methods such as virtual private networks and advised that VPNs should be updated to the most current version available. CISA also noted that a VPN is only as secure as the connected devices.
The agency advised organizations to conduct impact analysis and risk assessments before deploying defensive measures. It encouraged organizations that observe suspected malicious activity to follow established internal procedures and report findings to CISA for tracking and correlation with other incidents. CISA also recommended precautions against social engineering, including not clicking web links or opening attachments in unsolicited email messages.
CISA said no known public exploitation specifically targeting these vulnerabilities had been reported to the agency at the time of the advisory. Abdiwelli Guled reported the vulnerabilities to CISA, according to the notice. The advisory was initially released on Sept. 3.