CVE-2025-15680

TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device's circuit board without sufficient protection. A physically proximate attacker can connect to the UART interface and observe the device boot process and runtime debug output. The disclosed information includes operating system details, software versions, network configuration, filesystem paths, and other implementation and debugging information that may assist an attacker in further compromising the device.

CVSS

No CVSS.

References

Link	Resource
https://en.tbea.com/about.html

Configurations

No configuration.

History

29 Sep 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) TBEA TLogger V2.1.0.0B0.0.0.0 expone una interfaz UART en la placa de circuito del dispositivo sin protección suficiente. Un atacante físicamente próximo puede conectarse a la interfaz UART y observar el proceso de arranque del dispositivo y la salida de depuración en tiempo de ejecución. La información revelada incluye detalles del sistema operativo, versiones de software, configuración de red, rutas del sistema de archivos y otra información de implementación y depuración que puede ayudar a un atacante a comprometer aún más el dispositivo.

Information

Published : 2026-08-10 20:17

Updated : 2026-09-29 11:10

NVD link : CVE-2025-15680

Mitre link : CVE-2025-15680

CVE.ORG link : CVE-2025-15680

JSON object : View

Products Affected

No product.

CWE

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

{"id": "CVE-2025-15680", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15680", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T18:10:23.103102Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "office@cyberdanube.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.4, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "office@cyberdanube.com", "affectedData": [{"vendor": "TBEA", "product": "TBEA TLogger (TBEA Communication Box 3rd Generation)", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "V2.1.0.0B0.0.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-10T20:17:25.010", "references": [{"url": "https://en.tbea.com/about.html", "source": "office@cyberdanube.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "office@cyberdanube.com", "description": [{"lang": "en", "value": "CWE-497"}]}], "descriptions": [{"lang": "en", "value": "TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device's circuit board without sufficient protection. A physically proximate attacker can connect to the UART interface and observe the device boot process and runtime debug output. The disclosed information includes operating system details, software versions, network configuration, filesystem paths, and other implementation and debugging information that may assist an attacker in further compromising the device."}, {"lang": "es", "value": "TBEA TLogger V2.1.0.0B0.0.0.0 expone una interfaz UART en la placa de circuito del dispositivo sin protecci\u00f3n suficiente. Un atacante f\u00edsicamente pr\u00f3ximo puede conectarse a la interfaz UART y observar el proceso de arranque del dispositivo y la salida de depuraci\u00f3n en tiempo de ejecuci\u00f3n. La informaci\u00f3n revelada incluye detalles del sistema operativo, versiones de software, configuraci\u00f3n de red, rutas del sistema de archivos y otra informaci\u00f3n de implementaci\u00f3n y depuraci\u00f3n que puede ayudar a un atacante a comprometer a\u00fan m\u00e1s el dispositivo."}], "lastModified": "2026-09-29T11:10:00.150", "sourceIdentifier": "office@cyberdanube.com"}