CVE-2025-13293: Tbea Tlogger Tbea Communication Box 3rd Generation

Critical severity, CVSS 9.3. EPSS: 0.5% chance of exploitation in the next 30 days.

A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticate to the SSH service. Successful exploitation provides full administrative control of the affected device.

Affected products

• Tbea Tbea Tlogger Tbea Communication Box 3rd Generation: up to and including V2.1.0.0B0.0.0.0

Published 2026-08-10. Last modified 2026-09-29.