Which versions of TBEA TLogger are affected by CVE-2025-13294?

TBEA TLogger (Communication Box 3rd Generation) firmware V2.1.0.0B0.0.0.0 is vulnerable to unauthenticated remote SQL injection affecting multiple HTTP endpoints, allowing complete read, modify, and…

How to fix or mitigate CVE-2025-13294?

Within 24 hours: Complete an inventory of all TBEA TLogger (3rd Generation) devices running firmware V2.1.0.0B0.0.0.0 across operational technology deployments; immediately restrict inbound HTTP and HTTPS access to these devices via firewall rules, permitting connections only from designated administrative networks, bastion hosts, or VPNs. Within 7 days: Deploy network segmentation by placing all affected devices on isolated VLANs separated from business-critical systems; enable Web Application Firewall logging to detect SQL injection attack patterns; document the current state of all CCU.db databases and store encrypted offline backups. Within 30 days: Monitor TBEA vendor security advisories and CISA alerts weekly for patch releases; when a patch becomes available, validate it in a test environment before production deployment; if no patch emerges within 60 days, evaluate alternative communication box solutions or request vendor guidance on permanent mitigations.

TBEA TLogger CVE-2025-13294

Q: What is the CVSS score of CVE-2025-13294?

CVE-2025-13294 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2025-210667 CRITICAL

SQL Injection (CWE-89)

2026-08-10 CyberDanube

GHSA-w4wx-fgc2-5x27

SQLi Tbea Tlogger Tbea Communication Box 3Rd Generation Tbea

9.3

CVSS 4.0 · Vendor: CyberDanube

Severity by source

Vendor (CyberDanube) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote, unauthenticated, low-complexity HTTP injection with no user interaction (AV:N/AC:L/PR:N/UI:N) fully compromising the SQLite database yields high C/I/A on an unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 20:02 vuln.today

CVE Published

Aug 10, 2026 - 19:25 cve.org

CRITICAL 9.3

DescriptionCVE.org

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploit these endpoints to read, modify, or delete data stored in the device's CCU.db database.

AnalysisAI

SQL injection in the web server of TBEA TLogger (TBEA Communication Box 3rd Generation), firmware V2.1.0.0B0.0.0.0, lets a remote unauthenticated attacker inject SQL through multiple HTTP endpoints that build SQLite queries from attacker-controlled parameters. Successful exploitation allows reading, altering, or deleting all records in the device's on-board CCU.db database, giving full compromise of the logger's stored data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.3 and the unauthenticated network vector make it a high-priority defect for affected operational-technology deployments.

Technical ContextAI

TLogger is a data-logging / communication gateway (a 'communication box') used to collect and relay telemetry from TBEA energy equipment such as solar/PV and power-conversion gear, so it typically sits on an OT or field network. The device runs an embedded web server backed by a local SQLite file, CCU.db, which stores configuration and collected measurement data. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): several HTTP endpoints concatenate request parameters directly into SQLite statements instead of using parameterized/prepared queries, so crafted input alters query structure. The affected product is identified by CPE cpe:2.3:a:tbea:tbea_tlogger_(tbea_communication_box_3rd_generation), and the flaw class is characteristic of hand-built query strings in embedded firmware where input validation and parameter binding are frequently omitted.

RemediationAI

No vendor-released patch is identified at time of analysis, and the only supplied reference is the vendor's general site (https://en.tbea.com/about.html) rather than a fix advisory, so operators should contact TBEA to confirm whether a firmware update beyond V2.1.0.0B0.0.0.0 addresses the SQL injection before assuming a fix exists. In the absence of a patch, the primary compensating control is to remove the device's web server from any untrusted reachability: place TLogger on an isolated OT VLAN and block inbound access to its HTTP/management port from IT and internet-facing networks, accepting that remote monitoring will then require a jump host or VPN. Additionally restrict access to the vulnerable HTTP endpoints via an upstream firewall or reverse proxy allowlisting only known management hosts, and deploy network monitoring/WAF rules to flag SQL metacharacters in request parameters - noting these rules can produce false positives and do not fix the underlying flaw. Because CCU.db integrity can be altered, maintain and validate off-device backups of logged data so tampering or deletion can be detected and recovered.