This vulnerability (CVE-2025-13294) affects the TBEA TLogger (TBEA Communication Box 3rd Generation) version V2.1.0.0B0.0.0.0. It is an unauthenticated SQL injection flaw where multiple HTTP endpoints accept parameters that are directly used in SQLite queries without proper validation or parameterization. This allows a remote attacker with no authentication to execute arbitrary SQL commands on the device's CCU.db database, potentially leading to unauthorized data access, modification, or deletion. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

A remote unauthenticated attacker can exploit this SQL injection vulnerability to read sensitive data, modify existing data, or delete data stored in the device's CCU.db database. This compromises the confidentiality, integrity, and availability of the affected system's data. Given the critical CVSS score and lack of authentication required, the impact is severe for systems running the affected version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a patch is available, restrict network access to the affected device's web server to trusted users only and monitor for suspicious activity targeting the HTTP endpoints. Avoid exposing the device to untrusted networks.