Three Flaws in a Remote Site Controller

CISA issued ICSA-26-246-08 on 3 September for the Tycon Systems TPDIN-Monitor-WEB3, a remote power and site controller, covering three issues in versions 2.2.9 and prior. CVE-2026-77847 is use of hard-coded credentials, CWE-798, at CVSS v3.1 6.5 and v4.0 7.1, allowing interception of sensitive information or credentials. CVE-2026-82712 is cross-site request forgery, CWE-352, at 8.8 and 8.6, allowing state-changing operations on the device. CVE-2026-82684 is a missing authorisation, CWE-862, at 8.1 and 8.6, allowing extraction of system credentials, configurations or flash contents. Firmware v2.4.2 fixes them, distributed as an Intel HEX file for field units. The listed sectors are critical manufacturing and energy; the finder is credited as Abdiwelli Guled.

The device class is what makes this worth reading rather than filing. A remote power controller sits at an unmanned site — a repeater hut, a well head, a solar array, a remote pumping station — and its job is to switch power, monitor a battery and let somebody reboot equipment without driving four hours. It is, almost by definition, internet-reachable, because remote access is the entire reason it exists. That combination of reachability and a small vendor's embedded web stack is where this category of advisory keeps coming from.

The three flaws compound in a specific way worth spelling out. Hard-coded credentials mean the same secret exists on every unit shipped, so extracting it from one device or one firmware image yields access to all of them. The missing authorisation allows configuration and flash extraction, which is how that secret gets found. And the CSRF means an authenticated operator merely visiting a malicious page can cause the device to act — which in this case means switching power at a remote site. Read together, the realistic scenario is not a targeted attack on one installation but an internet-wide sweep against a device population.

The firmware distribution format is the operational catch. An Intel HEX file for field units means flashing at a low level rather than uploading an image through a web interface, which in practice means a site visit or a technician with a programmer — exactly the travel the device was bought to avoid. Anyone with a fleet of these should plan the campaign accordingly and, in the meantime, take the reachability question seriously: putting the unit behind a VPN or a cellular private APN rather than a port-forward removes the CSRF and the unauthenticated paths from the internet entirely, and costs nothing but configuration. And the hard-coded credential is worth treating as permanently compromised even after patching, because it was never a secret in the first place.