Tycon Systems TPDIN-Monitor-WEB2 Cleartext Storage of Sensitive Information

published 2026-07-24 3 mo ago modified 2026-10-24 15 d ago also EUVD-2026-48744

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits: 0; none known

The web management interface in Tycon Systems TPDIN-Monitor-WEB2

stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used to compromise other systems on the local network.

Patch / fix

fixed in 1

Tycon Systems TPDIN-Monitor-WEB2 2.4.5

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-202-01 updated 2026-09-03 cvss 4.3

Tycon Systems TPDIN-Monitor-WEB2 (Update A)

Tycon Systems TPDIN-Monitor-WEB2 <2.4.5
affected: vendor fix, mitigation “Tycon Systems recommends changing any factory-default SNMP community strings and the Telnet password if they were left at shipped values. Leave Telnet disabled unless required.”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 3 mo ago (2026-07-27)

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Tycon Systems TPDIN-Monitor-WEB2

Classification

Weakness

CWE-312 Cleartext Storage of Sensitive Information

References

Sources

CVE List CVE-2026-55985
NVD CVE-2026-55985

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary