TBEA TLogger version V2.1.0.0B0.0.0.0 contains an authentication bypass vulnerability in its web server. Specifically, after a legitimate user has authenticated, an unauthenticated attacker can directly access protected functions through the /index.asp endpoint without valid credentials. This flaw allows unauthorized access to functionality intended only for authenticated users, risking exposure or modification of device configuration and data. Additionally, attempting to log out from this bypassed state can cause the web server to crash. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function).

The vulnerability allows unauthenticated attackers to bypass authentication controls and access sensitive device functions, potentially leading to unauthorized disclosure or modification of device configuration and data. The web server may also crash when logging out from the bypassed state, causing denial of service. The CVSS 4.0 base score is 9.2 (critical), reflecting high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, restrict access to the device's web interface to trusted networks and users to reduce exposure.