Which versions of TBEA TLogger are affected by CVE-2025-13293?

TBEA Communication Box 3rd Generation (TLogger V2.1.0.0B0.0.0.0) contains hard-coded default root credentials accessible over SSH, enabling unauthenticated remote attackers to gain full…

How to fix or mitigate CVE-2025-13293?

Within 24 hours: Inventory all TBEA TLogger V2.1.0.0B0.0.0.0 devices in production and assess which are directly exposed to networks. Immediately restrict SSH access to these devices using firewall rules, limiting connections to trusted administrative networks only and disabling external SSH access where operationally feasible. Within 7 days: If password modification is supported, change the root credentials on all affected devices and document the new credentials in your secure credential vault; simultaneously enable SSH access logging and implement real-time alerting for successful root authentications. Simultaneously contact TBEA for patch availability and expected timeline. Within 30 days: Develop a replacement or upgrade strategy for affected devices; if patched firmware becomes available, apply it enterprise-wide; if no patch is released by vendor, plan migration to alternative communication box solutions.

TBEA TLogger CVE-2025-13293

Q: What is the CVSS score of CVE-2025-13293?

CVE-2025-13293 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2025-210666 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-08-10 CyberDanube

GHSA-8hj2-2q8g-jqhw

Authentication Bypass Tbea Tlogger Tbea Communication Box 3Rd Generation Tbea

9.3

CVSS 4.0 · Vendor: CyberDanube

Severity by source

Vendor (CyberDanube) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Static root credential reused fleet-wide over network SSH yields unauthenticated, low-complexity remote root, so PR:N/AC:L/AV:N with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 20:00 vuln.today

CVE Published

Aug 10, 2026 - 19:24 cve.org

CRITICAL 9.3

DescriptionCVE.org

A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticate to the SSH service. Successful exploitation provides full administrative control of the affected device.

AnalysisAI

Root-level device takeover in TBEA TLogger V2.1.0.0B0.0.0.0 (the TBEA Communication Box 3rd Generation) stems from a hard-coded/default root credential exposed over the device's SSH service, letting remote attackers authenticate as root and gain full administrative control. The static root password can be derived from the /etc/shadow hash and, being shared across devices, works fleet-wide once recovered. There is no public exploit identified at time of analysis and no CISA KEV listing, but the flaw was independently reported by ICS researcher CyberDanube and carries a critical CVSS 4.0 base score of 9.3.

Technical ContextAI

The affected asset is an industrial data-logging/communication gateway (TBEA Communication Box 3rd Generation) used to aggregate and forward telemetry, typically in power/energy and monitoring deployments. The root cause is CWE-798 (Use of Hard-coded Credentials): the firmware ships a fixed or default root account whose password hash resides in /etc/shadow. Because the same credential is baked into the firmware image, an attacker who cracks the hash (offline, from a firmware dump or one obtained device) holds a universal key. The exposed SSH daemon then provides the network-reachable authentication surface, so cracking the static hash directly translates to interactive root shell access on any device running this build.

RemediationAI

No vendor-released patch identified at time of analysis, and no fixed firmware version is named in the available data, so the primary action is to contact TBEA directly (vendor site https://en.tbea.com/about.html) for patched firmware or credential-rotation guidance and to confirm whether the hard-coded root account can be changed or disabled. As compensating controls: remove the device's SSH service from all untrusted and internet-facing networks and restrict SSH to a dedicated management VLAN or jump host (trade-off: legitimate remote administration must be re-routed through that path); block inbound TCP/22 to these devices at the OT/IT boundary firewall and allow it only from explicitly whitelisted management IPs (trade-off: breaks any remote tooling relying on direct SSH); and if the platform permits, change or disable the root login and enforce key-based authentication (trade-off: may be overwritten by firmware or unsupported on embedded builds, so verify persistence after reboot). Because the credential is static and shared, network isolation is the most reliable control until vendor-fixed firmware is confirmed.