CVE-2025-15681
Received Received - Intake

Authentication Bypass in TBEA TLogger V2.1.0.0B0.0.0.0

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: CyberDanube

Description
TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the attacker to access functionality intended for authenticated users and may expose or modify device configuration and data. Logging out from the bypassed state can additionally cause the web server to crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-11
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2025-15681
EUVD
EUVD-2025-210669

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tbea tlogger 2.1.0.0b0.0.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

TBEA TLogger V2.1.0.0B0.0.0.0 has an authentication bypass flaw in its web server. After a user logs in once, an attacker can access protected features by directly visiting the /index.asp endpoint without re-entering credentials. This lets them view or change device settings and data meant for authorized users. Logging out from this bypassed state may crash the web server.

Detection Guidance

Check web server logs for direct access attempts to /index.asp without prior authentication. Monitor for crashes after logout events. Inspect network traffic for unauthenticated requests to protected endpoints.

Impact Analysis

An attacker could exploit this to access sensitive device configurations or data without permission. They might alter settings, steal information, or disrupt device operations. The crash after logout could also cause temporary unavailability of the web interface.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using this device may face compliance failures, legal penalties, and reputational damage.

Mitigation Strategies

Apply vendor patches if available. Restrict access to /index.asp via network firewall rules. Disable unauthenticated direct access to protected functionality. Monitor device stability and logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart