Tycon Systems TPDIN-Monitor-WEB2 (Update A): 2 CVEs, Critical 9.8
Summary
CISA reports 2 vulnerabilities in Tycon Systems TPDIN-Monitor-WEB2. Weakness types: Missing Authentication for Critical Function, Cleartext Storage of Sensitive Information. Successful exploitation of these vulnerabilities could result in an attacker accessing sensitive credentials, disrupting connected infrastructure, or manipulating physical equipment, which could present a physical safety risk. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.
At a glance
- Vendor
- Tycon Systems
- Products
- TPDIN-Monitor-WEB2
- CVEs
- CVE-2026-61884, CVE-2026-55985
- Highest CVSS v3
- 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-61884 | Missing Authentication for Critical Function | 9.8 | – | No | The device ships without HTTP credentials configured, intended for an installer to set them on first use. On firmware 2.4.4 and earlier, a unit left in this unconfigured state serves the web management interface without requiring any login. An attacker with network access to such a unit can reach full device controls, including power relay management, device reboot, remote access service configura… |
| CVE-2026-55985 | Cleartext Storage of Sensitive Information | 4.3 | – | No | The device's web management interface stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used to compromise other systems on the local network. |
Affected products (1)
- Tycon Systems TPDIN-Monitor-WEB2: <2.4.5
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Tycon Systems has released firmware 2.4.5, which resolves this vulnerability by requiring an administrator username and password to be set before the web interface is served. Further inquiries can be directed to security@tyconsystems.com.
- Mitigation: Tycon Systems recommends setting an administrative username and strong password on the Network Configuration page and confirming in a private browser window that a login is required, for units still running firmware 2.4.4 or earlier. Repeat this after any factory reset.
- Mitigation: Tycon Systems recommends not exposing the web interface to the Internet, as it is HTTP only. The unit should be kept on a private network, behind a firewall or VPN.
- Vendor Fix: Tycon Systems has released firmware 2.4.5, which resolves this vulnerability by removing cleartext credentials from the web interface response. Further inquiries can be directed to security@tyconsystems.com.
- Mitigation: Tycon Systems recommends changing any factory-default SNMP community strings and the Telnet password if they were left at shipped values. Leave Telnet disabled unless required.
- Mitigation: Tycon Systems recommends using a dedicated mail account for device alerts, rather than an account also used for other sensitive purposes, to limit exposure if credentials are compromised.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.