CISA warns of three flaws in Tycon Systems TPDIN-Monitor-WEB3

By Atlas Watchline Staff · Regulatory · September 3, 2026

CISA said Tycon Systems’ TPDIN-Monitor-WEB3 has three vulnerabilities in versions 2.2.9 and earlier, and that firmware v2.4.2 is available as a fix.

CISA said Tycon Systems’ TPDIN-Monitor-WEB3 has three vulnerabilities in versions 2.2.9 and earlier, and that firmware v2.4.2 is available as a fix.

What happened

CISA issued an advisory on Tycon Systems’ TPDIN-Monitor-WEB3, saying versions 2.2.9 and earlier are affected by three vulnerabilities. The agency identified the issues as use of hard-coded credentials, cross-site request forgery and missing authorization.

CISA said successful exploitation could let an attacker intercept sensitive information, trigger a man-in-the-middle attack, force a factory reset, wipe credentials or retrieve sensitive data from the device. It said the hard-coded credentials issue could expose credentials or other sensitive information, while the CSRF flaw could allow state-changing actions on the device. The missing authorization issue could allow extraction of system credentials, configurations or flash contents.

What CISA said

CISA said the advisory places the product in the Critical Manufacturing and Energy sectors and that it is deployed worldwide. It rated the three issues as medium or high severity under CVSS v3.1 and high severity under CVSS v4.0.

Context and background

CISA identified the vendor as Tycon Systems, which is headquartered in the United States. The agency said the advisory was first published on 2026-09-03 and that no known public exploitation specifically targeting these vulnerabilities has been reported to CISA so far.

The three tracked vulnerabilities are CVE-2026-77847, CVE-2026-82712 and CVE-2026-82684. CISA assigned CVSS v3.1 scores of 6.5, 8.8 and 8.1, respectively. Under CVSS v4.0, the scores were 7.1, 8.6 and 8.6.

Firmware update

CISA said Tycon Systems has released firmware v2.4.2. The agency provided two mitigation downloads: a signed .tfw container for units already running v2.4.2, and an Intel HEX .hex file for field units, including those on v2.2.9.

CISA said a unit running v2.2.9 can install the .hex build directly and reach v2.4.2 in one step, with no intermediate version required. It added that the .tfw container cannot be read by a v2.2.9 updater, which accepts only Intel HEX.

CISA credited Abdiwelli Guled with reporting the vulnerabilities.

What happens next

Operators using Tycon Systems TPDIN-Monitor-WEB3 will need to review their installed version and apply the firmware path CISA lists for their devices. CISA’s advisory links to the firmware downloads and says the .hex artifact is the path for deployed units on older builds.

Sources

• CISA advisory

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.