This vulnerability (CVE-2025-13293) affects TBEA TLogger version 2.1.0.0B0.0.0.0 and is classified as CWE-798 (Use of Hard-coded Credentials). An attacker with network access to the device's SSH service can recover the root password from the stored password hash in /etc/shadow without authentication. Exploiting this flaw grants full root access, compromising the device's security and administrative functions. The CVSS 4.0 score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated remote attacker to obtain root-level access to the affected device. This grants full administrative control, enabling the attacker to manipulate device configurations, disrupt operations, or pivot within the network. The vulnerability severely compromises the confidentiality, integrity, and availability of the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's SSH service to trusted hosts only and monitor for unauthorized access attempts. Consider disabling SSH access if operationally feasible.