Which versions of TBEA TLogger are affected by CVE-2025-15681?

TBEA TLogger (V2.1.0.0B0.0.0.0), a data-logging device deployed across power and photovoltaic infrastructure, contains a critical authentication bypass enabling unauthenticated remote attackers to…

How to fix or mitigate CVE-2025-15681?

Within 24 hours, identify all TBEA TLogger devices running firmware V2.1.0.0B0.0.0.0 in your environment and document their network location and operational criticality. Within 7 days, implement firewall rules restricting access to the web management interface (/index.asp) to trusted administration networks only, and contact TBEA directly to confirm patch availability and expected release timeline. Within 30 days, evaluate vendor patch release status; if no patch is forthcoming, prepare contingency plans including device replacement, network redesign to isolate affected systems, or migration to alternative monitoring solutions.

TBEA TLogger CVE-2025-15681

Q: What is the CVSS score of CVE-2025-15681?

CVE-2025-15681 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2025-210669 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-08-10 CyberDanube

GHSA-m738-f6gp-rv3j

Authentication Bypass Tbea Tlogger Tbea Communication Box 3Rd Generation Tbea

9.2

CVSS 4.0 · Vendor: CyberDanube

Severity by source

Vendor (CyberDanube) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable web endpoint (AV:N) but bypass depends on a pre-existing authenticated session, so AC:H; no attacker credentials needed (PR:N); full config read/modify and logout-crash give C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 20:05 vuln.today

CVE Published

Aug 10, 2026 - 19:31 cve.org

CRITICAL 9.2

DescriptionCVE.org

TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the attacker to access functionality intended for authenticated users and may expose or modify device configuration and data. Logging out from the bypassed state can additionally cause the web server to crash.

AnalysisAI

Authentication bypass in the web management server of TBEA TLogger (firmware V2.1.0.0B0.0.0.0), a data-logging communication box used with TBEA power/photovoltaic equipment, lets an unauthenticated remote attacker reach the protected /index.asp endpoint once any legitimate user has previously authenticated to the device. The attacker can then view and alter device configuration and data intended only for authenticated users, and triggering a logout from the bypassed session can crash the web server. Rated CVSS 4.0 9.2 (Critical); no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

TBEA TLogger is an embedded ICS/OT communication box (marketed as the TBEA Communication Box 3rd Generation) that exposes an ASP-based web interface for monitoring and configuring attached power/PV equipment. The root cause is CWE-306 (Missing Authentication for a Critical Function): the /index.asp endpoint and its protected functions do not independently enforce authentication, instead relying on a device-wide or shared session state established by a prior legitimate login. Because the session/authentication check is tied to device state rather than the individual request, any subsequent request can inherit that authenticated context. The AT:P (attack requirements: present) metric in the CVSS 4.0 vector reflects the dependency on a pre-existing authenticated session, and the logout-induced crash suggests fragile session/state handling in the embedded web server.

RemediationAI

No vendor-released patch identified at time of analysis - no fixed firmware version or security advisory was provided in the source data (the only reference is the vendor corporate page https://en.tbea.com/about.html). As compensating controls: remove the device from any internet exposure and place it on an isolated OT/management VLAN reachable only through a jump host or VPN, since the vulnerability requires network reachability to /index.asp; restrict access to the web interface by IP allow-listing at an upstream firewall so only authorized engineering workstations can reach it (trade-off: breaks remote monitoring workflows). Because the bypass depends on a prior authenticated session and logout can crash the server, minimize the number and duration of active admin sessions and avoid leaving the web UI logged in. Monitor for unexpected /index.asp access and for web-server crashes/restarts, and contact TBEA directly to obtain patched firmware and confirm which builds are affected before relying on version-based mitigation.