Description

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-04T21:17:26.100Z",
  "pubdate": "2026-09-04T21:17:26.100Z",
  "executiveSummary": "Tycon Systems TPDIN-Monitor-WEB3, in versions 2.2.9 and prior, is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. This security flaw enables an unauthenticated or authenticated attacker to coerce a victim's browser into executing unauthorized state-changing operations against the device's web management interface.\nThe vulnerability resides in the application's failure to adequately validate or provide anti-CSRF tokens for sensitive administrative requests. By inducing an authenticated user to visit a malicious or compromised website, an attacker can manipulate device settings, modify configurations, or perform other unauthorized actions with the privileges of the victim.\nGiven that TPDIN-Monitor devices are typically used for infrastructure management, the potential impact includes unauthorized control over power outlets, environmental sensor settings, and network configurations. The risk is significant as it bypasses intended authentication controls, allowing for remote manipulation without the victim's explicit consent. Exploitation requires only that the target user maintain an active session with the web interface while browsing external content.",
  "technicalDetails": "The vulnerability in Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior stems from an absence of proper request validation mechanisms, specifically the lack of Cross-Site Request Forgery (CSRF) protection such as unique, cryptographically strong anti-CSRF tokens or SameSite cookie attributes.\nIn a standard CSRF attack flow, the web application relies solely on ambient credentials—such as session cookies or HTTP Basic Authentication headers—to verify user identity. Because browsers automatically include these credentials with every request made to the origin domain, the device's web server cannot distinguish between an intentional administrative request initiated by the authorized user and a forged request initiated by a third-party site.\nTo exploit this, an attacker hosts a malicious document (e.g., an HTML file containing a hidden form or an asynchronous JavaScript fetch request) on an external domain. When a user with an active management session to the TPDIN-Monitor-WEB3 interface navigates to the attacker-controlled site, the embedded script sends a forged HTTP request (GET or POST) to the TPDIN device's web interface. If the device's management interface expects specific request parameters to perform operations such as power-cycling outlets, toggling relay states, or updating system network settings, the attacker can pre-populate these parameters within the forged request.\nThe vulnerable component is the web-based administrative management module, which fails to enforce strict origin verification or utilize synchronization tokens to validate the intent of state-changing operations. Because the device processes these requests under the context of the user's current authenticated session, the server executes the requested actions as if they were originated by the legitimate administrator.\nThis vulnerability is particularly impactful in industrial or remote power management environments where the TPDIN-Monitor-WEB3 is deployed. Post-exploitation, an attacker can effectively seize control of the hardware, leading to unauthorized disruption of power delivery to connected equipment, alteration of security parameters, or complete administrative lock-out. The attack does not require direct access to the device’s management network, as the browser of the victim serves as the intermediary, bypassing local network access control lists (ACLs) or firewalls."
}