Vulnerability · Published Aug 10, 2026 · Assigned by CyberDanube
CVE-2025-13294Unauthenticated SQL Injection
Critical 9.3
In plain English
A critical-severity SQL injection in TBEA TLogger (TBEA Communication Box 3rd Generation) from TBEA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).
Official description
An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploit these endpoints to read, modify, or delete data stored in the device's CCU.db database.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TBEA | TBEA TLogger (TBEA Communication Box 3rd Generation) | 0 – through V2.1.0.0B0.0.0.0 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N