CVE-2026-82712: CWE-352 in Tycon Systems TPDIN-Monitor-WEB3

CVE-2026-82712 is a cross-site request forgery (CWE-352) vulnerability affecting Tycon Systems TPDIN-Monitor-WEB3 devices running version 2.2.9 and prior. This vulnerability allows remote attackers to induce state-changing actions on the device without proper user consent or authentication. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the device is not a cloud service.

Successful exploitation could allow an attacker to perform unauthorized state-changing operations on the affected device, potentially leading to full compromise of confidentiality, integrity, and availability of the device functions. This could disrupt device operation or expose sensitive information controlled by the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing compensating controls such as restricting network access to the device management interface and ensuring that users are trained to avoid interacting with suspicious links or requests that could trigger CSRF attacks.