CVE-2025-15683

TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig.

CVSS

No CVSS.

References

Link	Resource
https://en.tbea.com/about.html

Configurations

No configuration.

History

29 Sep 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) TBEA TLogger V2.1.0.0B0.0.0.0 contiene múltiples vulnerabilidades de denegación de servicio no autenticadas en su servidor web. Un atacante remoto no autenticado puede invocar puntos finales HTTP específicos para reiniciar o restablecer el dispositivo, borrar datos de la aplicación o terminar el servidor web mediante un fallo de segmentación. Además, múltiples puntos finales de acción procesan parámetros controlados por el atacante utilizando operaciones de cadena inseguras como sprintf() y strcat() sin una comprobación de límites adecuada, permitiendo que una entrada manipulada active desbordamientos de búfer y bloquee el servidor web. Los puntos finales afectados incluyen onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm y UpdatePortConfig.

Information

Published : 2026-08-10 20:17

Updated : 2026-09-29 11:10

NVD link : CVE-2025-15683

Mitre link : CVE-2025-15683

CVE.ORG link : CVE-2025-15683

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-15683", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15683", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T18:17:06.895069Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "office@cyberdanube.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "office@cyberdanube.com", "affectedData": [{"vendor": "TBEA", "product": "TBEA TLogger (TBEA Communication Box 3rd Generation)", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "V2.1.0.0B0.0.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-10T20:17:25.420", "references": [{"url": "https://en.tbea.com/about.html", "source": "office@cyberdanube.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "office@cyberdanube.com", "description": [{"lang": "en", "value": "CWE-121"}, {"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig."}, {"lang": "es", "value": "TBEA TLogger V2.1.0.0B0.0.0.0 contiene m\u00faltiples vulnerabilidades de denegaci\u00f3n de servicio no autenticadas en su servidor web. Un atacante remoto no autenticado puede invocar puntos finales HTTP espec\u00edficos para reiniciar o restablecer el dispositivo, borrar datos de la aplicaci\u00f3n o terminar el servidor web mediante un fallo de segmentaci\u00f3n. Adem\u00e1s, m\u00faltiples puntos finales de acci\u00f3n procesan par\u00e1metros controlados por el atacante utilizando operaciones de cadena inseguras como sprintf() y strcat() sin una comprobaci\u00f3n de l\u00edmites adecuada, permitiendo que una entrada manipulada active desbordamientos de b\u00fafer y bloquee el servidor web. Los puntos finales afectados incluyen onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm y UpdatePortConfig."}], "lastModified": "2026-09-29T11:10:00.150", "sourceIdentifier": "office@cyberdanube.com"}