Tycon TPDIN-Monitor-WEB3 firmware patches hard-coded creds, CSRF, missing auth
The patch is a legacy .hex file, no signed container path for the v2.2.9 units that need it most, so every deployed device requires a manual flash.
TL;DR
CISA disclosed three vulnerabilities in Tycon Systems TPDIN-Monitor-WEB3 firmware ≤2.2.9: hard-coded credentials (CVE-2026-77847, CVSS 6.5), cross-site request forgery (CVE-2026-82712, CVSS 8.8), and missing authorization (CVE-2026-82684, CVSS 8.1). The devices are deployed worldwide in critical manufacturing and energy networks. Tycon released firmware v2.4.2, but units on v2.2.9 can't ingest the signed .tfw container, they need the legacy Intel HEX build, which means a direct, out-of-band flash for every fielded unit.
The three vulnerabilities sit in the device's web management interface. CVE-2026-77847 is a hard-coded credential that, per the CVSS v3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), lets an attacker on the adjacent network extract credentials without authentication. CVE-2026-82712 is a CSRF flaw that allows state-changing operations (factory reset, configuration wipe) when an attacker can reach an authenticated user's browser session. CVE-2026-82684 is a missing-authorization gap that lets an authenticated user extract system credentials, configurations, or flash contents beyond what their privileges should permit.
The CVSS scores tell a story of escalating severity as the attacker moves from eavesdropping to control. The hard-coded credential (6.5) is the entry point. The CSRF (8.8) and missing authorization (8.1) are what you do once you're in. The advisory doesn't describe chaining, but the adjacency vector on the credential disclosure and the network-accessible CSRF and auth bypass land on the same attack surface.
The patch path that matters
Tycon provides two firmware artifacts for v2.4.2: a signed .tfw container for units already on a modern firmware track, and a legacy Intel HEX file for everything else. The CISA advisory states directly that "the signed .tfw container cannot be read by a v2.2.9 updater, which accepts only Intel HEX." A unit on v2.2.9 installs the .hex build in a single step and arrives at v2.4.2 (no intermediate version required) but the .hex file is the one every deployed unit needs.
For OT teams in manufacturing and energy, this means a maintenance window. These devices monitor power relays and manage remote-site equipment. The advisory doesn't estimate the deployed base, but the predecessor TPDIN-Monitor-WEB2 line had its own CISA advisory earlier this year (ICSA-26-202-01) covering missing authentication and cleartext credential storage, and that product family is deployed worldwide. The WEB3 joins a pattern.
This is the second Tycon advisory in as many months. The WEB2 advisory in July covered a device that shipped without HTTP credentials configured and would serve the management interface unauthenticated until the installer set them. The WEB3's hard-coded credential problem is a different flavor of the same root issue: authentication assumptions that don't survive contact with a network. Organizations running both product lines should check whether they're also behind on the WEB2 patch to v2.4.5.
Published ·Deep Fathom