Tycon Systems has released firmware version 2.4.2 to address three vulnerabilities in its TPDIN-Monitor-WEB3 device, affecting versions 2.2.9 and earlier. The flaws could enable an attacker to intercept credentials, perform unauthorized state-changing operations, retrieve sensitive information, reset a device to factory settings, or wipe credentials, the Cybersecurity and Infrastructure Security Agency said in an industrial control systems advisory published Sept. 3.
The most severe issue is a cross-site request forgery flaw, tracked as CVE-2026-82712, with a CVSS 3.1 score of 8.8. CISA said exploitation could allow an attacker to perform state-changing operations on the device. The vulnerability is described as requiring network access and user interaction but no privileges, according to the advisory’s scoring details.
A missing-authorization flaw, CVE-2026-82684, carries a CVSS 3.1 score of 8.1. It could allow an attacker with limited privileges to extract system credentials, configurations, or flash contents. The advisory assigns the flaw to CWE-862, the category for missing authorization.
The third issue, CVE-2026-77847, involves hard-coded credentials and has a CVSS 3.1 score of 6.5. CISA said the weakness could allow an attacker to intercept sensitive information or credentials. The advisory identifies the issue as CWE-798, or use of hard-coded credentials.
CISA’s summary describes the affected equipment as deployed worldwide and lists critical manufacturing and energy among the sectors in which it is used. The agency said successful exploitation could support man-in-the-middle attacks, factory resets, credential wiping, or the retrieval of sensitive information. The vulnerabilities were reported to CISA by Abdiwelli Guled.
Tycon’s fix is firmware version 2.4.2. Devices already running version 2.4.2 should use the signed .tfw container for later updates, while all units currently in the field should use the legacy Intel HEX .hex file identified in the advisory. The distinction matters because a version 2.2.9 updater cannot read the signed container and accepts only the Intel HEX format.
A device running version 2.2.9 can install the Intel HEX build directly and reach version 2.4.2 in one step. CISA said no intermediate firmware version is required. The advisory directs users seeking more information to Tycon Systems and provides links to both firmware files and the company’s contact page.
CISA recommends minimizing network exposure for control-system devices, keeping them off the public internet, placing control networks and remote devices behind firewalls, and isolating them from business networks. When remote access is necessary, the agency recommends more secure methods such as current VPN deployments while warning that VPN security also depends on the connected devices. CISA said no known public exploitation specifically targeting these vulnerabilities had been reported at the time of the advisory.