Tbea Tlogger Tbea Communication Box 3Rd Generation
Monthly
Unauthenticated remote denial-of-service and device manipulation in TBEA TLogger V2.1.0.0B0.0.0.0 (Communication Box 3rd Generation) allows any network-adjacent attacker to reboot or factory-reset the device, erase application data, or crash the web server - all without credentials. Beyond the missing authentication (CWE-306), multiple data-handling endpoints use unsafe C-style string operations (sprintf, strcat) without bounds checking, providing a second crash vector via crafted parameter input. No public exploit identified at time of analysis, and the device has not been added to the CISA KEV catalog.
TBEA TLogger V2.1.0.0B0.0.0.0 (Communication Box 3rd Generation) exposes an unauthenticated HTTP PUT endpoint at /tmp/ that allows any remote attacker to permanently write attacker-controlled files to the device's filesystem under /opt/myapp/webserver/. Because the web server attempts to move these files into a non-existent directory, cleanup never occurs, and repeated requests exhaust available storage and cause a denial-of-service condition. No public exploit has been identified at time of analysis, but the attack requires only network reachability and no credentials, making exploitation trivially automatable.
Authentication bypass in the web management server of TBEA TLogger (firmware V2.1.0.0B0.0.0.0), a data-logging communication box used with TBEA power/photovoltaic equipment, lets an unauthenticated remote attacker reach the protected /index.asp endpoint once any legitimate user has previously authenticated to the device. The attacker can then view and alter device configuration and data intended only for authenticated users, and triggering a logout from the bypassed session can crash the web server. Rated CVSS 4.0 9.2 (Critical); no public exploit identified at time of analysis and not listed in CISA KEV.
Physical access to the TBEA TLogger V2.1.0.0B0.0.0.0 (Communication Box 3rd Generation) PCB exposes an unprotected UART debug interface, allowing a physically proximate attacker to intercept the device boot process and runtime debug output without any authentication. Disclosed data - including OS version strings, software versions, network configuration, filesystem paths, and implementation internals - provides a reconnaissance foundation that can materially assist subsequent compromise of the device or connected infrastructure. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
SQL injection in the web server of TBEA TLogger (TBEA Communication Box 3rd Generation), firmware V2.1.0.0B0.0.0.0, lets a remote unauthenticated attacker inject SQL through multiple HTTP endpoints that build SQLite queries from attacker-controlled parameters. Successful exploitation allows reading, altering, or deleting all records in the device's on-board CCU.db database, giving full compromise of the logger's stored data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.3 and the unauthenticated network vector make it a high-priority defect for affected operational-technology deployments.
Root-level device takeover in TBEA TLogger V2.1.0.0B0.0.0.0 (the TBEA Communication Box 3rd Generation) stems from a hard-coded/default root credential exposed over the device's SSH service, letting remote attackers authenticate as root and gain full administrative control. The static root password can be derived from the /etc/shadow hash and, being shared across devices, works fleet-wide once recovered. There is no public exploit identified at time of analysis and no CISA KEV listing, but the flaw was independently reported by ICS researcher CyberDanube and carries a critical CVSS 4.0 base score of 9.3.
Unauthenticated remote denial-of-service and device manipulation in TBEA TLogger V2.1.0.0B0.0.0.0 (Communication Box 3rd Generation) allows any network-adjacent attacker to reboot or factory-reset the device, erase application data, or crash the web server - all without credentials. Beyond the missing authentication (CWE-306), multiple data-handling endpoints use unsafe C-style string operations (sprintf, strcat) without bounds checking, providing a second crash vector via crafted parameter input. No public exploit identified at time of analysis, and the device has not been added to the CISA KEV catalog.
TBEA TLogger V2.1.0.0B0.0.0.0 (Communication Box 3rd Generation) exposes an unauthenticated HTTP PUT endpoint at /tmp/ that allows any remote attacker to permanently write attacker-controlled files to the device's filesystem under /opt/myapp/webserver/. Because the web server attempts to move these files into a non-existent directory, cleanup never occurs, and repeated requests exhaust available storage and cause a denial-of-service condition. No public exploit has been identified at time of analysis, but the attack requires only network reachability and no credentials, making exploitation trivially automatable.
Authentication bypass in the web management server of TBEA TLogger (firmware V2.1.0.0B0.0.0.0), a data-logging communication box used with TBEA power/photovoltaic equipment, lets an unauthenticated remote attacker reach the protected /index.asp endpoint once any legitimate user has previously authenticated to the device. The attacker can then view and alter device configuration and data intended only for authenticated users, and triggering a logout from the bypassed session can crash the web server. Rated CVSS 4.0 9.2 (Critical); no public exploit identified at time of analysis and not listed in CISA KEV.
Physical access to the TBEA TLogger V2.1.0.0B0.0.0.0 (Communication Box 3rd Generation) PCB exposes an unprotected UART debug interface, allowing a physically proximate attacker to intercept the device boot process and runtime debug output without any authentication. Disclosed data - including OS version strings, software versions, network configuration, filesystem paths, and implementation internals - provides a reconnaissance foundation that can materially assist subsequent compromise of the device or connected infrastructure. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
SQL injection in the web server of TBEA TLogger (TBEA Communication Box 3rd Generation), firmware V2.1.0.0B0.0.0.0, lets a remote unauthenticated attacker inject SQL through multiple HTTP endpoints that build SQLite queries from attacker-controlled parameters. Successful exploitation allows reading, altering, or deleting all records in the device's on-board CCU.db database, giving full compromise of the logger's stored data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.3 and the unauthenticated network vector make it a high-priority defect for affected operational-technology deployments.
Root-level device takeover in TBEA TLogger V2.1.0.0B0.0.0.0 (the TBEA Communication Box 3rd Generation) stems from a hard-coded/default root credential exposed over the device's SSH service, letting remote attackers authenticate as root and gain full administrative control. The static root password can be derived from the /etc/shadow hash and, being shared across devices, works fleet-wide once recovered. There is no public exploit identified at time of analysis and no CISA KEV listing, but the flaw was independently reported by ICS researcher CyberDanube and carries a critical CVSS 4.0 base score of 9.3.