CVE-2026-61884 & CVE-2026-55985: Tycon TPDIN-Monitor-WEB2 Critical Flaws — ICS Detection and Remediation Guide

CISA has published ICS Advisory ICSA-26-202-01 (Update A) covering two critical vulnerabilities in Tycon Systems' TPDIN-Monitor-WEB2, a web-managed remote power monitoring and control device deployed worldwide in the Critical Manufacturing sector. The advisory carries a combined CVSS v3 score of 9.8 (Critical) — and the consequences here are not confined to data loss. These devices control physical power to connected equipment. An unauthenticated attacker can disrupt connected infrastructure, manipulate physical equipment, and create a genuine physical safety risk.

If you run TPDIN-Monitor-WEB2 units anywhere in your environment — substations, telecom enclosures, manufacturing floors, remote sites — treat this as an urgent remediation item. All firmware versions below 2.4.5 are affected.

Technical Analysis

Affected Products and Versions

Vulnerability Breakdown

CVE-2026-61884 — Missing Authentication for Critical Function (CWE-306). Per CISA, the device ships without HTTP authentication protecting critical management functions. In practical terms, any host that can reach the device's web interface can invoke privileged functionality — reading configuration, altering power states, toggling relay outputs — without presenting credentials. This is the worst-case posture for an OT device: exploitability requires nothing more than network reachability and an HTTP client. No session token, no credential theft, no exploit chain. curl is sufficient.

CVE-2026-55985 — Cleartext Storage of Sensitive Information (CWE-312). Sensitive credentials are stored on the device in cleartext. Once an attacker gains any level of access to the device filesystem or configuration export (trivially achievable via CVE-2026-61884), they recover usable credentials — which frequently include credentials reused for adjacent infrastructure such as SNMP communities, upstream management accounts, or site VPN secrets. This is how a single exposed power monitor becomes a lateral movement beachhead.

Attack Chain (Defender's View)

1. Discovery: Attacker scans for exposed TPDIN-Monitor-WEB2 interfaces — these devices are routinely found indexed on Shodan/Censys when improperly exposed to the internet or reachable from flat internal networks.
2. Unauthenticated access: Direct HTTP requests to the management interface invoke critical functions without authentication (CVE-2026-61884).
3. Credential harvest: Cleartext stored credentials are extracted from device configuration (CVE-2026-55985).
4. Impact: Attacker cycles power to connected loads, disrupts connected infrastructure, manipulates physical equipment, and pivots deeper into the OT/IT environment using recovered credentials.

Exploitation Status

At the time of this writing, CISA has not reported confirmed in-the-wild exploitation, and neither CVE has been added to the CISA Known Exploited Vulnerabilities catalog. However, a CVSS 9.8 unauthenticated flaw on a device class that is historically internet-exposed should be treated as pre-exploitation — scanning for these units will begin (if it hasn't already) as soon as advisory details circulate. Assume exposure until verified otherwise.

Detection & Response

The TPDIN-Monitor-WEB2 is an embedded OT device — you will not deploy an EDR agent to it. Detection must therefore concentrate on network-layer telemetry: proxy logs, firewall logs, NetFlow, and Syslog forwarded into your SIEM. The highest-fidelity signals are (1) HTTP requests to device management interfaces originating from outside the approved OT management jump hosts, and (2) any internet-bound or internet-originated session involving these devices.

Before deploying the detections below, build an asset inventory of your TPDIN units and define the small set of authorized management hosts. Every detection here is scoped around that allowlist — that is what keeps these rules quiet and actionable.

Sigma Rules

---
title: Unauthenticated HTTP Access to Tycon TPDIN-Monitor-WEB2 Management Interface
id: 4c8e2a71-9b3d-4f56-a210-7d5e9c1b8a02
status: experimental
description: Detects HTTP requests to Tycon TPDIN-Monitor-WEB2 power management interfaces originating from hosts outside the authorized OT management allowlist. CVE-2026-61884 allows unauthenticated access to critical device functions on firmware < 2.4.5.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-01
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/21
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: zeek
  service: http
detection:
  selection_target:
    uri|contains:
      - '/index.html'
      - '/cgi-bin/'
      - '/status'
      - '/control'
      - '/config'
  selection_resp:
    status_code:
      - 200
      - 302
  filter_authorized_mgmt:
    src_ip|cidr:
      - '10.50.0.0/24' # Replace with authorized OT management/jump-host subnet
  condition: selection_target and selection_resp and not filter_authorized_mgmt
falsepositives:
  - Authorized management hosts not yet added to the allowlist
  - Vulnerability scanners and asset inventory tools (tune by scanner IP)
level: high
---
title: Internet-Originated Connection to OT Power Management Device
id: 8f1d4c92-6a7b-4e38-b945-2c6d8f3a9e17
status: experimental
description: Detects connection attempts from external/public IP space toward OT segments hosting Tycon TPDIN-Monitor-WEB2 devices (default web management on TCP/80 and TCP/443). These devices must never be internet-reachable; CVE-2026-61884 requires only network reachability.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-01
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/21
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: firewall
detection:
  selection_dst_port:
    dst_port:
      - 80
      - 443
  selection_dst_ot:
    dst_ip|cidr:
      - '10.60.0.0/16' # Replace with your OT/power-management VLAN ranges
  filter_internal:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_dst_port and selection_dst_ot and not filter_internal
falsepositives:
  - Misconfigured NAT or port-forwarding rules (investigate immediately — this is itself a finding)
level: critical

Both rules require environment-specific scoping: replace the placeholder CIDR ranges with your actual OT management subnets and device VLANs. The first rule will fire on internal scanning and misconfigured clients — investigate every hit, because any non-allowlisted host touching these devices is a policy violation independent of the CVE.

KQL (Microsoft Sentinel / Defender)

// Hunt: Unauthorized HTTP access to Tycon TPDIN-Monitor-WEB2 devices (ICSA-26-202-01)
// Ingests firewall/proxy traffic via CEF (CommonSecurityLog). Scope DestinationIP to your TPDIN inventory.
let TpdinDevices = dynamic(["10.60.1.11", "10.60.1.12"]); // Replace with discovered TPDIN-Monitor-WEB2 IPs
let AuthorizedMgmt = dynamic(["10.50.0.10", "10.50.0.11"]); // Replace with OT jump hosts
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationIP in (TpdinDevices)
| where DestinationPort in (80, 443)
| where not(SourceIP in (AuthorizedMgmt))
| project TimeGenerated, SourceIP, SourcePort, DestinationIP, DestinationPort,
          Protocol, RequestURL, RequestMethod, DeviceAction, DeviceName
| sort by TimeGenerated desc;

// Hunt: External (public) source IPs communicating with OT power-management segments
// Flags potential direct internet exposure of TPDIN units — a critical finding on its own.
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationIP startswith "10.60." // Replace with your OT segment prefix
| where ipv4_is_private(SourceIP) == false
| where DestinationPort in (80, 443, 161, 22, 23)
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by SourceIP, DestinationIP, DestinationPort, DeviceAction
| sort by ConnectionCount desc;

Velociraptor VQL

Velociraptor cannot run on the embedded device, but it is effective for hunting the engineering workstations and jump hosts that legitimately manage these units — the systems an attacker would target or abuse to reach the TPDIN interfaces. This artifact surfaces unexpected processes holding connections to your device VLAN.

-- Hunt: Unexpected processes with established connections to TPDIN-Monitor-WEB2 device VLAN
-- Scope the CIDR to your OT power-management segment. Approved tools (browser on jump host,
-- vendor utilities) should be a small, known set — anything else is anomalous.
LET device_subnet = '10.60.'  -- Replace with your TPDIN management VLAN prefix

SELECT Pid,
       Name,
       Exe,
       Username,
       CommandLine,
       netstat().RemoteAddr.IP AS RemoteIP,
       netstat().RemoteAddr.Port AS RemotePort,
       netstat().Status AS ConnStatus
FROM pslist()
WHERE netstat().RemoteAddr.IP =~ device_subnet
  AND netstat().RemoteAddr.Port in (80, 443, 23, 161)
  AND NOT Name =~ '(?i)(chrome|firefox|msedge|iexplore)\\.exe'
ORDER BY Username, Name

Remediation & Verification Script

This Bash script discovers TPDIN-Monitor-WEB2 units on your management VLAN, fingerprints the firmware version via the device's web interface, flags anything below 2.4.5, and verifies the units are not reachable from outside the authorized management host. Run it from an authorized OT jump host.

#!/bin/bash
# TPDIN-Monitor-WEB2 (ICSA-26-202-01) discovery and firmware verification
# Run from an authorized OT management host. Requires: nmap, curl

OT_SUBNET="10.60.1.0/24"          # REPLACE: your power-management device VLAN
TARGET_PORT=80
REQUIRED_FW="2.4.5"
REPORT="tpdin_audit_$(date +%Y%m%d).csv"

echo "ip,http_status,server_banner,fw_version,remediation_required" > "$REPORT"

echo "[*] Discovering web interfaces on $OT_SUBNET ..."
HOSTS=$(nmap -p "$TARGET_PORT" --open -oG - "$OT_SUBNET" | awk '/open/{print $2}')

for ip in $HOSTS; do
  # Banner-grab and pull the page to identify TPDIN-Monitor-WEB2 and extract firmware version
  BANNER=$(curl -sk -m 5 -D - "http://$ip/" -o /tmp/tpdin_body.$$ | grep -i '^Server:' | tr -d '\r')
  BODY=$(cat /tmp/tpdin_body.$$ 2>/dev/null)

  if echo "$BODY" | grep -qi "TPDIN"; then
    FW=$(echo "$BODY" | grep -oiE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
    HTTP_CODE=$(curl -sk -m 5 -o /dev/null -w '%{http_code}' "http://$ip/")

    # Version comparison: flag anything below 2.4.5 or unparseable
    if [ -z "$FW" ] || [ "$(printf '%s\n%s\n' "$REQUIRED_FW" "$FW" | sort -V | head -1)" != "$REQUIRED_FW" ]; then
      VULN="YES - CVE-2026-61884 / CVE-2026-55985 (upgrade to $REQUIRED_FW)"
    else
      VULN="no"
    fi
    echo "$ip,$HTTP_CODE,\"$BANNER\",$FW,$VULN" | tee -a "$REPORT"
  fi
  rm -f /tmp/tpdin_body.$$
done

echo "[*] Checking for internet exposure (egress/ingress sanity checks) ..."
# The device should have NO default route to the internet. From your firewall,
# verify no NAT/port-forward maps public IPs to device VLAN addresses.
# Locally, confirm the device VLAN cannot reach public DNS:
for ip in $(awk -F, 'NR>1 {print $1}' "$REPORT"); do
  if ping -c1 -W2 "$ip" &>/dev/null; then
    echo "[!] MANUAL CHECK: verify firewall blocks ingress/egress for $ip"
  fi
done

echo "[*] Audit complete. Results in $REPORT"
grep ",YES" "$REPORT" && echo "[!!] VULNERABLE UNITS FOUND — isolate and upgrade immediately" || echo "[+] No vulnerable units detected"

Remediation

1. Inventory first. You cannot patch what you haven't found. Run the discovery script above against every OT, facilities, and remote-site VLAN. TPDIN units are frequently deployed by facilities teams outside IT's asset management — check tower sites, equipment enclosures, and UPS/solar installations.
2. Upgrade firmware to version 2.4.5 or later. Obtain the update through Tycon Systems' official support channels. Verify the firmware image hash against vendor-published values before applying — never source ICS firmware from third-party mirrors.
3. Rotate every credential the device stores or touches. Because of CVE-2026-55985, assume cleartext credentials on any unit that was network-reachable are compromised. Rotate device passwords, SNMP community strings, and any account that shares a password with the device.
4. Remove all internet exposure — immediately. These devices must never be reachable from the public internet. Audit NAT rules, port forwards, and any "temporary" remote access configurations. Query Shodan/Censys for your public IP ranges to confirm nothing is indexed.
5. Enforce network segmentation. Place TPDIN units on a dedicated OT management VLAN. Permit access only from hardened jump hosts, only over required ports, and log everything (CISA ICS guidance: minimize network exposure, locate control system networks behind firewalls, isolate from business networks).
6. Disable unused services. If Telnet or SNMP v1/v2c is enabled on the units, disable or upgrade to SNMPv3 with strong credentials.
7. Deploy the detections above and alert on any non-allowlisted host communicating with the device VLAN.
8. Review CISA's recommended practices for ICS defense-in-depth and report any suspected targeting to CISA's 24/7 Operations Center.

Official references:

• CISA ICS Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-01
• CISA ICS Recommended Practices: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Bottom Line

A CVSS 9.8 unauthenticated flaw on a device that physically controls power to connected equipment is the definition of a priority-one OT remediation. The patch exists — firmware 2.4.5 closes both CVE-2026-61884 and CVE-2026-55985. The hard part is rarely the patch; it's the asset inventory and the segmentation debt that let these devices sit exposed in the first place. Fix the firmware this week, then fix the architecture that made it dangerous.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub