PT-2026-69925

Name of the Vulnerable Software and Affected Versions TBEA TLogger version 2.1.0.0B0.0.0.0 Description A hard-coded or default root account credential allows an unauthenticated remote attacker to gain root-level access to the device through the exposed SSH service. The root password can be...

CVE-2025-15680: Exposure of Sensitive System Information to an Unauthorized Control Sphere

TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device's circuit board without sufficient protection. A physically proximate attacker can connect to the UART interface and observe the device boot process and runtime debug output. The disclosed information includes operating system...

CVE-2025-15683: Missing Authentication for Critical Function

TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation faul...

CVE-2025-15682: Allocation of Resources Without Limits or Throttling

TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the /tmp/ endpoint, causing the web server to create persistent files containing attacker-controlled data under...

PT-2026-69927

Name of the Vulnerable Software and Affected Versions TBEA TLogger version 2.1.0.0B0.0.0.0 Description The device exposes a UART Universal Asynchronous Receiver-Transmitter, a hardware communication protocol interface on the circuit board without sufficient protection. An attacker with physical...

PT-2026-69928

Name of the Vulnerable Software and Affected Versions TBEA TLogger version 2.1.0.0B0.0.0.0 Description The web server contains an authentication bypass. If a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality via the '/index.as...

PT-2026-69930

Name of the Vulnerable Software and Affected Versions TBEA TLogger version 2.1.0.0B0.0.0.0 Description The web server contains multiple unauthenticated denial-of-service issues. A remote attacker can trigger a device reboot, reset the device, clear application data, or cause a segmentation fault ...

PT-2026-69926

Name of the Vulnerable Software and Affected Versions TBEA TLogger version 2.1.0.0B0.0.0.0 Description An unauthenticated SQL injection exists in the web server where multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or...

CVE-2025-13293: Use of Hard-coded Credentials

A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticat...