Critical Vulnerabilities Discovered in Tycon Systems TPDIN-Monitor-WEB2 Firmware

Tycon Systems TPDIN-Monitor-WEB2 (Update A) devices running firmware versions earlier than 2.4.5 are affected by two significant security vulnerabilities. CVE-2026-61884, rated CRITICAL with a CVSS score of 9.8, stems from the device shipping without HTTP credentials configured. On firmware 2.4.4 and earlier, a unit left in this unconfigured state serves the web management interface without requiring any login. An attacker with network access to such a unit can achieve full device controls, including power relay management, device reboot, remote access service configuration, and network settings changes. This could allow disruption of connected infrastructure or physical damage to equipment.

CVE-2026-55985, rated MEDIUM with a CVSS score of 4.3, involves the web management interface storing and displaying system credentials in cleartext on a configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used to compromise other systems on the local network.

Tycon Systems has released firmware version 2.4.5, which resolves both vulnerabilities. The update requires an administrator username and password to be set before the web interface is served, and removes cleartext credentials from the web interface response. The vendor also recommends that users set an administrative username and strong password on the Network Configuration page, confirm that a login is required in a private browser window, and avoid exposing the web interface to the Internet, keeping the unit on a private network behind a firewall or VPN.

The vulnerabilities were reported to CISA by researcher Abdiwelli Guled. Affected sectors include Critical Manufacturing, with deployments worldwide.