CVE-2026-82712

Received Received - Intake

Cross-Site Request Forgery in Tycon Systems TPDIN-Monitor-WEB3

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: ICS-CERT

Description

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2026-82712

Affected Vendors & Products

Vendor	Product	Version / Range
tycon_systems	tpdin_monitor_web3	to 2.2.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior have a cross-site request forgery (CSRF) vulnerability. This allows an attacker to trick a user into executing unwanted actions on the device through their browser session.

Detection Guidance

Detection of this CSRF vulnerability in Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior requires manual inspection of network traffic and device configurations. Monitor HTTP requests for unauthorized state-changing operations like configuration changes or device reboots. Check logs for unusual POST requests without proper CSRF tokens.

Impact Analysis

An attacker could perform unauthorized state-changing operations on the device, such as modifying settings or disabling functions, potentially disrupting operations or causing security issues.

Compliance Impact

The vulnerability allows attackers to perform unauthorized state-changing operations via cross-site request forgery, which could lead to unauthorized access or modifications. This may impact compliance with GDPR by risking unauthorized data processing or access, and with HIPAA by potentially exposing protected health information through unauthorized device control.

Mitigation Strategies

Immediate mitigation steps include updating TPDIN-Monitor-WEB3 to the latest version beyond 2.2.9 if available. If no update exists, restrict network access to the device's web interface via firewalls or VLAN segmentation. Implement network-level monitoring for suspicious activity and disable unnecessary services on the device.

Hi! I’m here to help you understand CVE-2026-82712. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70