CVE-2025-15681criticalCWE-306

CVE-2025-15681: falha crítica em TBEA TLogger (TBEA Communication Box 3rd…

Insufficient Webserver Authentication

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar TBEA TLogger

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.7%
TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the attacker to access functionality intended for authenticated users and may expose or modify device configuration and data. Logging out from the bypassed state can additionally cause the web server to crash.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
TBEA · TBEA TLogger (TBEA Communication Box 3rd Generation)
CVEs relacionadas — TBEA TLogger (TBEA Communication Box 3rd…

No mesmo produto, das mais perigosas para as menos.

CVE-2025-15683HIGHMultiple Unauthenticated Denial-of-Service ConditionsEPSS 0.6%CVE-2025-13294CRITICALUnauthenticated SQL InjectionEPSS 0.6%CVE-2025-15682HIGHUnauthenticated Resource ExhaustionEPSS 0.5%CVE-2025-13293CRITICALBackdoor / default root credentialsEPSS 0.5%CVE-2025-15680LOWInformation Disclosure via UARTEPSS 0.2%