CVE-2025-15683

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15683", "assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc", "state": "PUBLISHED", "assignerShortName": "CyberDanube", "dateReserved": "2026-08-04T11:34:49.423Z", "datePublished": "2026-08-10T19:38:57.641Z", "dateUpdated": "2026-08-12T18:17:21.333Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc", "shortName": "CyberDanube", "dateUpdated": "2026-08-10T19:38:57.641Z"}, "title": "Multiple Unauthenticated Denial-of-Service Conditions", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-121", "description": "CWE-121 Stack-based buffer overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}, {"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "affected": [{"vendor": "TBEA", "product": "TBEA TLogger (TBEA Communication Box 3rd Generation)", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "V2.1.0.0B0.0.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as <code>sprintf()</code> and <code>strcat()</code> without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include <code>onRestart</code>, <code>onReset</code>, <code>ClearData</code>, <code>uploadInvFile</code>, <code>getIndiaRPData</code>, <code>YearCaparity</code>, <code>TotalfaultData</code>, <code>recordData</code>, <code>InvHistoryData</code>, <code>CollectHistoryData</code>, <code>InvFaultData</code>, <code>GetPortTableByParm</code>, and <code>UpdatePortConfig</code>."}]}], "references": [{"url": "https://en.tbea.com/about.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "S. Eisenreich-Dietz (CyberDanube)", "type": "finder"}, {"lang": "en", "value": "T. Weber (CyberDanube)", "type": "finder"}, {"lang": "en", "value": "F. Koroknai", "type": "finder"}, {"lang": "en", "value": "D. Blagojevic", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T18:17:06.895069Z", "id": "CVE-2025-15683", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T18:17:21.333Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15683", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T18:17:06.895069Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T18:17:14.686Z"}}], "cna": {"title": "Multiple Unauthenticated Denial-of-Service Conditions", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "S. Eisenreich-Dietz (CyberDanube)"}, {"lang": "en", "type": "finder", "value": "T. Weber (CyberDanube)"}, {"lang": "en", "type": "finder", "value": "F. Koroknai"}, {"lang": "en", "type": "finder", "value": "D. Blagojevic"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}, {"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TBEA", "product": "TBEA TLogger (TBEA Communication Box 3rd Generation)", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "V2.1.0.0B0.0.0.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://en.tbea.com/about.html"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig.", "supportingMedia": [{"type": "text/html", "value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as <code>sprintf()</code> and <code>strcat()</code> without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include <code>onRestart</code>, <code>onReset</code>, <code>ClearData</code>, <code>uploadInvFile</code>, <code>getIndiaRPData</code>, <code>YearCaparity</code>, <code>TotalfaultData</code>, <code>recordData</code>, <code>InvHistoryData</code>, <code>CollectHistoryData</code>, <code>InvFaultData</code>, <code>GetPortTableByParm</code>, and <code>UpdatePortConfig</code>.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based buffer overflow"}]}], "providerMetadata": {"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc", "shortName": "CyberDanube", "dateUpdated": "2026-08-10T19:38:57.641Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15683", "state": "PUBLISHED", "dateUpdated": "2026-08-12T18:17:21.333Z", "dateReserved": "2026-08-04T11:34:49.423Z", "assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc", "datePublished": "2026-08-10T19:38:57.641Z", "assignerShortName": "CyberDanube"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "TBEA TLogger (TBEA Communication Box 3rd Generation)", "vendor": "TBEA", "versions": [{"lessThanOrEqual": "V2.1.0.0B0.0.0.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "office@cyberdanube.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig."}, {"lang": "es", "value": "TBEA TLogger V2.1.0.0B0.0.0.0 contiene m\u00faltiples vulnerabilidades de denegaci\u00f3n de servicio no autenticadas en su servidor web. Un atacante remoto no autenticado puede invocar puntos finales HTTP espec\u00edficos para reiniciar o restablecer el dispositivo, borrar datos de la aplicaci\u00f3n o terminar el servidor web mediante un fallo de segmentaci\u00f3n. Adem\u00e1s, m\u00faltiples puntos finales de acci\u00f3n procesan par\u00e1metros controlados por el atacante utilizando operaciones de cadena inseguras como sprintf() y strcat() sin una comprobaci\u00f3n de l\u00edmites adecuada, permitiendo que una entrada manipulada active desbordamientos de b\u00fafer y bloquee el servidor web. Los puntos finales afectados incluyen onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm y UpdatePortConfig."}], "id": "CVE-2025-15683", "lastModified": "2026-09-29T11:10:00.150", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "office@cyberdanube.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15683", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T18:17:06.895069Z", "version": "2.0.3"}}]}, "published": "2026-08-10T20:17:25.420", "references": [{"source": "office@cyberdanube.com", "url": "https://en.tbea.com/about.html"}], "sourceIdentifier": "office@cyberdanube.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}, {"lang": "en", "value": "CWE-306"}], "source": "office@cyberdanube.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,V2.1.0.0B0.0.0.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "TBEA TLogger (TBEA Communication Box 3rd Generation)", "source": "cna", "vendor": "TBEA"}, "product": "tbea_tlogger", "vendor": "tbea"}], "created": "2026-08-10T21:00:04.265046+00:00", "updated": "2026-08-11T14:21:53.028039+00:00", "vendors": ["tbea", "tbea$PRODUCT$tbea_tlogger"]}