TPDIN-Monitor-WEB3 CVE-2026-82684

Low-privilege authenticated access to the TPDIN-Monitor-WEB3 web management interface is required, consistent with the CVSS 4.0 PR:L metric - the attacker must hold at least some valid credentials for the device. The device must be reachable over the network (AV:N); no physical proximity or local console access is required. No special non-default configuration or feature enablement is noted as a prerequisite - the vulnerability is present in the base product for all versions through 2.2.9. Exploitation is limited by the need for prior credential acquisition and by network reachability; devices placed on isolated OT segments not accessible from untrusted hosts or from the internet have significantly reduced exposure, and no user interaction on the device side is required once access conditions are met.

The CVSS 4.0 score of 8.6 reflects a genuinely high-impact, low-complexity attack requiring only low-privilege credentials (PR:L) over the network (AV:N). The confidentiality impact (VC:H) from credential and configuration extraction is the primary driver; the integrity impact (VI:H) is attributable to the fact that extracted credentials enable subsequent unauthorized write access and device reconfiguration. No CISA KEV listing or public proof-of-concept code has been identified, keeping this outside the immediately-exploited tier, but EPSS data was not provided so exploitation probability cannot be independently scored. The OT context is a meaningful risk amplifier: power monitoring devices are frequently internet-adjacent or accessible across flat corporate-OT network boundaries, and missing authorization bugs in ICS web interfaces are among the most commonly targeted vulnerability classes in operational technology environments - even a mid-sized municipal IT team in walbrzych managing distributed DC power infrastructure should treat this as an urgent patching priority rather than a deferred maintenance item. The PR:L requirement does limit opportunistic exploitation, as some form of credentials must first be obtained.

An attacker who has obtained low-privilege credentials to the TPDIN-Monitor-WEB3 web interface - for example, through a shared monitoring account or credential reuse from a related system - sends HTTP requests directly to administrative endpoints that lack server-side authorization enforcement. The device responds with system credentials, network configuration, or flash memory contents, which the attacker uses to escalate to full administrative control or extract network topology data for further lateral movement. No public proof-of-concept exists, but missing authorization checks in web interfaces require minimal technical skill to discover and exploit via standard HTTP proxying tools.