SQL Injection Vulnerability in TBEA TLogger Web Server
CVE-2025-13294

9.3CRITICAL

Key Information:

Vendor

Tbea

Status
Tbea Tlogger (tbea Communication Box 3rd Generation)
Vendor
CVE Published:
10 August 2026

What is CVE-2025-13294?

An unauthenticated SQL injection vulnerability exists in the TBEA TLogger web server that could allow an attacker to exploit multiple HTTP endpoints. These endpoints inadequately incorporate user-supplied parameters into SQLite database queries, lacking necessary validation and parameterization. This opens up the potential for remote attackers to read, modify, or delete critical data in the CCU.db database, posing a significant security risk to the integrity and confidentiality of the stored information.

Affected Version(s)

TBEA TLogger (TBEA Communication Box 3rd Generation) 0

References

https://en.tbea.com/about.html

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

S. Eisenreich-Dietz (CyberDanube)
T. Weber (CyberDanube)
F. Koroknai
D. Blagojevic
.