Tycon TPDIN-Monitor-WEB2: Two Flaws Expose Relays and Configurations to Remote Control

CISA updated its advisory on September 3, 2026, concerning two vulnerabilities in the Tycon Systems TPDIN-Monitor-WEB2 (Update A) device. All firmware versions prior to 2.4.5 are affected.

The most serious flaw, tracked as CVE-2026-61884, allows attackers to bypass web authentication and obtain a fully privileged administrative session. The second, CVE-2026-55985, exposes certain system credentials in readable form to already authenticated users.

An attacker could modify network settings, alter remote-access services, reboot the device, and control its power relays. In an industrial environment, the impact could extend to connected equipment.

Advisory update clarifies the vulnerable versions

The advisory was initially published on July 21, 2026. The September 3, 2026 update corrected the affected-version range and incorporated technical details provided by the manufacturer.

The current scope is as follows:

Product	Vulnerable versions	Fixed version
Tycon Systems TPDIN-Monitor-WEB2 (Update A)	Firmware versions prior to 2.4.5	2.4.5

Tycon Systems is based in the United States, while the device is distributed worldwide. The affected sector is identified as Critical Manufacturing. The vulnerabilities were reported to CISA by Abdiwelli Guled.

The issue does not affect all Tycon products in the same family. In particular, TPDIN-Monitor-WEB3 is a separate device, with different firmware and vulnerabilities, and should not be confused with the WEB2 model covered by this advisory.

CVE-2026-61884 enables an administrative session without login

CVE-2026-61884 is the primary vulnerability. It has a CVSS 3.1 score of 9.8 out of 10, rated critical, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The vector describes a network-based attack with low complexity that requires no prior privileges or user interaction. Confidentiality, integrity, and availability can all be fully compromised.

The device ships without preconfigured HTTP credentials. During initial setup, the installer is expected to configure an administrative username and password. In firmware versions 2.4.4 and earlier, however, failing to complete this step can leave the web panel effectively unprotected.

The technical analysis also identified insufficient server-side validation. An attacker can submit empty values in the credential fields and, on vulnerable devices, still obtain a valid administrative session.

This is not merely access to an informational page. The session exposes the device’s main operational functions, including:

• turning power relays on and off;
• rebooting the device;
• modifying network settings;
• configuring services used for remote access.

CISA classifies the weakness as CWE-306, Missing Authentication for Critical Function. NVD instead uses CWE-288, which covers authentication bypass through an alternate path. The classifications differ, but the CVSS 3.1 score and vector are the same.

Under CVSS 4.0, the vulnerability scores 9.3, which is also critical.

CVE-2026-55985 exposes readable credentials in the panel

The second vulnerability, CVE-2026-55985, concerns the handling of sensitive information in the web interface. A specific configuration page returns system credentials in readable form to authenticated users.

The vulnerability has a CVSS 3.1 score of 4.3, rated medium, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

In this case, the attacker must already have a valid account or session. No interaction from another person is required, and the direct impact is limited to confidentiality; data cannot be modified or made unavailable through this flaw alone.

The weakness is classified as CWE-312, Cleartext Storage of Sensitive Information. Its CVSS 4.0 score is 5.3, also rated medium.

Taken together, the two flaws can amplify the risk. Where the CVE-2026-61884 bypass allows an attacker to create an administrative session, that same session may expose the credentials affected by CVE-2026-55985. The recovered information could then be reused against other systems on the local network.

Firmware 2.4.5 removes these credentials from the response generated by the web interface.

From compromised relays to potential equipment damage

The TPDIN-Monitor-WEB2 controls functions that can affect the physical environment. The risk therefore goes beyond the compromise of an administrative account.

Manipulating the relays can cut power to connected infrastructure or disrupt its normal operating cycle. Even an unauthorized reboot can cause service interruptions, particularly when the device supports remote equipment or unattended installations.

Changing network settings could also make the system unreachable to legitimate operators. Altering remote-access services could create additional entry points or modify those used for maintenance.

The potential consequences therefore include operational outages and physical damage to equipment. The actual severity depends on how the device is deployed and which loads it controls.

The web interface increases exposure because it operates exclusively over HTTP. Credentials and session data are not protected by HTTPS during transmission. The panel should not be exposed directly to the Internet.

Firmware 2.4.5 and immediate security measures

The recommended fix is to install firmware 2.4.5, which addresses both vulnerabilities. The new version requires an administrative username and password to be configured before the web panel becomes available.

After updating, administrators should verify that the installed firmware is actually the corrected version. For systems that cannot be updated immediately, Tycon Systems recommends the following compensating measures:

1. configure strong administrative credentials on the Network Configuration page;
2. open the panel in a private browser window and verify that it prompts for login;
3. repeat the configuration and verification after every factory reset;
4. replace the default SNMP community strings;
5. change any Telnet password that is still set to the factory default;
6. keep Telnet disabled whenever it is not strictly necessary;
7. use a dedicated email account for alerts rather than an account used for sensitive activities.

The device should be placed on a private network protected by a firewall or made accessible through an up-to-date VPN. Control networks should be segmented from corporate networks, with connections limited to the required hosts and ports.

Before modifying devices in production, assess the potential impact on operational continuity. Mitigation measures should not introduce an outage more severe than the risk they are intended to reduce.

No known public exploitation and no KEV status reported

At the time of the advisory, there were no reports of targeted public exploitation of CVE-2026-61884 or CVE-2026-55985. No specific indicators of compromise were disclosed, such as IP addresses, HTTP requests, or files associated with attacks.

The advisory also does not indicate that either vulnerability has been added to CISA’s Known Exploited Vulnerabilities catalog. As a result, there is no associated federal KEV remediation deadline.

The absence of known public exploitation does not eliminate the need to act. The authentication bypass requires no credentials, has low attack complexity, and grants access to functions that can directly affect operations. The priority is to upgrade to firmware 2.4.5 and eliminate any direct exposure of the HTTP panel.