TPDIN-Monitor-WEB3 CVE-2026-77847

Adjacent network access to the TPDIN-Monitor-WEB3 device is required - the attacker must be on the same network segment or reachable LAN. No authentication, user interaction, or special device configuration is needed beyond network reachability; the hardcoded credentials are present in all devices running firmware v2.2.9 or earlier regardless of deployment configuration. Exploitation is limited by the AV:A constraint: devices isolated from untrusted networks via strict OT segmentation are not reachable by external attackers. The impact is read-only (VC:H, VI:N, VA:N), meaning the attacker can extract sensitive data but cannot modify device configuration or cause an outage through this vulnerability alone.

The CVSS 4.0 score of 7.1 with vector AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N reflects a realistic threat model: high confidentiality impact, no integrity or availability impact, and constrained to adjacent-network attackers. For ICS/OT environments, AV:A is a meaningful limitation since these devices are typically not internet-exposed, but internal threats or pivot attacks from a compromised IT network are plausible. The AC:L rating confirms trivial exploitation once network adjacency is achieved - no race conditions, no complex sequencing. No KEV listing and no public exploit have been identified at time of analysis, and the EPSS signal is unavailable; however, the ICS-CERT provenance and CISA advisory elevate credibility. For organizations with TPDIN-Monitor-WEB3 units in mixed IT/OT environments or remote-access-enabled industrial networks, real-world risk is meaningfully higher than the raw score implies.

An attacker with access to the industrial LAN - via a compromised workstation, a rogue device, or an IT/OT network bridge - extracts the hardcoded credentials from a publicly available firmware image or published analysis. The attacker then authenticates to the TPDIN-Monitor-WEB3 management interface using these credentials, gaining access to power monitoring telemetry, device configuration, and potentially stored network or system credentials. No public exploit code has been identified at time of analysis, but the low technical barrier (credential extraction from a downloadable firmware binary) makes independent rediscovery straightforward.