Which versions of TBEA TLogger are affected by CVE-2025-15683?

TBEA TLogger V2.1.0.0B0.0.0.0 communication devices are vulnerable to unauthenticated remote manipulation, allowing attackers on the local network to reboot devices, erase data, or crash the web…

How to fix or mitigate CVE-2025-15683?

Within 24 hours, inventory all TBEA TLogger V2.1.0.0B0.0.0.0 devices and document which systems control critical communication pathways; prioritize isolating business-critical instances from untrusted network segments. Within 7 days, implement strict network access controls (firewall rules restricting access to authorized IPs only), deploy continuous monitoring for unusual device restarts or configuration changes, and establish a configuration backup procedure to enable rapid recovery from factory resets. Within 30 days, contact TBEA for patch timelines and substitute roadmap; evaluate replacing affected devices with patched alternatives if production deployment is critical and no patch release is announced.

TBEA TLogger CVE-2025-15683

Q: What is the CVSS score of CVE-2025-15683?

CVE-2025-15683 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2025-210671 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-10 CyberDanube

GHSA-h63r-9fqg-pvq9

Authentication Bypass Tbea Tlogger Tbea Communication Box 3Rd Generation Tbea

8.8

CVSS 4.0 · Vendor: CyberDanube

Severity by source

Vendor (CyberDanube) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

AV:N and PR:N confirmed by CWE-306 and description; S:U as impact is contained to the TLogger device itself; C:N as no data exfiltration is described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 20:07 vuln.today

CVE Published

Aug 10, 2026 - 19:38 cve.org

HIGH 8.8

DescriptionCVE.org

TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig.

AnalysisAI

Unauthenticated remote denial-of-service and device manipulation in TBEA TLogger V2.1.0.0B0.0.0.0 (Communication Box 3rd Generation) allows any network-adjacent attacker to reboot or factory-reset the device, erase application data, or crash the web server - all without credentials. Beyond the missing authentication (CWE-306), multiple data-handling endpoints use unsafe C-style string operations (sprintf, strcat) without bounds checking, providing a second crash vector via crafted parameter input. No public exploit identified at time of analysis, and the device has not been added to the CISA KEV catalog.

Technical ContextAI

TBEA TLogger is an industrial OT communication and data logging device (3rd generation communication box) used in energy infrastructure, likely solar or power generation contexts given TBEA's primary business. The affected firmware version V2.1.0.0B0.0.0.0 exposes an embedded web server with at least fourteen named HTTP action endpoints - including onRestart, onReset, ClearData, uploadInvFile, GetPortTableByParm, and UpdatePortConfig among others. CWE-306 (Missing Authentication for Critical Function) identifies the root cause: administrative operations such as device restart, factory reset, and data clearing are reachable without any authentication gate. A secondary root cause present in the data-processing endpoints is classic stack or heap corruption through unbounded use of sprintf() and strcat() in C-language firmware, a pattern common in embedded IoT devices that lack modern memory-safe language protections or compiler mitigations.

RemediationAI

No vendor-released patch has been identified at time of analysis; the only reference provided leads to TBEA's generic corporate website rather than any security advisory or firmware download page. Operators should contact TBEA directly for firmware updates and monitor the vendor site for advisories. Until a patch is available, the most effective compensating control is network isolation: place TLogger devices behind a firewall or industrial DMZ that blocks all inbound HTTP access from untrusted networks, as all confirmed attack vectors require direct HTTP reachability. If remote management is operationally necessary, restrict access exclusively through a VPN or jump host, which eliminates the unauthenticated network exposure. Disabling the web server interface entirely (if the device supports CLI or local-only management) removes the attack surface at the cost of losing remote monitoring capability. Do not expose TLogger HTTP ports directly to the internet under any circumstances given the severity of the missing authentication.