CVE-2025-13294

Vulnerability Description

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploit these endpoints to read, modify, or delete data stored in the device's CCU.db database.

Related Weaknesses (CWE)

CWE-89

References

https://en.tbea.com/about.html

FAQ

What is CVE-2025-13294?

CVE-2025-13294 is a documented vulnerability. An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite querie...

How severe is CVE-2025-13294?

CVSS scoring is not yet available for CVE-2025-13294. Check NVD for updates.

Is there a patch for CVE-2025-13294?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.