CVE-2025-15682: CWE-770 Allocation of resources without limits or throttling in TBEA TBEA TLogger (TBEA Communication Box 3rd Generation)
TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the /tmp/ endpoint, causing the web server to create persistent files containing attacker-controlled data under /opt/myapp/webserver/. The generated files are not removed because the web server attempts to move them into a non-existent directory. Repeated requests can therefore exhaust available storage and cause a denial-of-service condition.
AI Analysis
Technical Summary
CVE-2025-15682 describes a resource exhaustion vulnerability (CWE-770) in TBEA TLogger (TBEA Communication Box 3rd Generation) version V2.1.0.0B0.0.0.0. The vulnerability arises because the web server accepts unauthenticated PUT requests to the /tmp/ endpoint, creating persistent files containing attacker-controlled data under /opt/myapp/webserver/. The server attempts to move these files to a directory that does not exist, so the files remain and accumulate. This lack of cleanup allows an unauthenticated remote attacker to exhaust available storage resources, leading to denial of service.
Potential Impact
An unauthenticated remote attacker can cause denial of service by exhausting storage on the affected system. This can disrupt normal operation of the TBEA TLogger web server and potentially impact availability of the device.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the TBEA TLogger web server to trusted users only to prevent unauthenticated PUT requests. Monitor storage usage to detect abnormal growth of files under /opt/myapp/webserver/ and manually remove unwanted files if necessary.
CVE-2025-15682: CWE-770 Allocation of resources without limits or throttling in TBEA TBEA TLogger (TBEA Communication Box 3rd Generation)
Description
TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the /tmp/ endpoint, causing the web server to create persistent files containing attacker-controlled data under /opt/myapp/webserver/. The generated files are not removed because the web server attempts to move them into a non-existent directory. Repeated requests can therefore exhaust available storage and cause a denial-of-service condition.
CVSS v4.0
Score 8.7high
Affected software
TBEA
TBEA TLogger (TBEA Communication Box 3rd Generation)
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-15682 describes a resource exhaustion vulnerability (CWE-770) in TBEA TLogger (TBEA Communication Box 3rd Generation) version V2.1.0.0B0.0.0.0. The vulnerability arises because the web server accepts unauthenticated PUT requests to the /tmp/ endpoint, creating persistent files containing attacker-controlled data under /opt/myapp/webserver/. The server attempts to move these files to a directory that does not exist, so the files remain and accumulate. This lack of cleanup allows an unauthenticated remote attacker to exhaust available storage resources, leading to denial of service.
Potential Impact
An unauthenticated remote attacker can cause denial of service by exhausting storage on the affected system. This can disrupt normal operation of the TBEA TLogger web server and potentially impact availability of the device.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the TBEA TLogger web server to trusted users only to prevent unauthenticated PUT requests. Monitor storage usage to detect abnormal growth of files under /opt/myapp/webserver/ and manually remove unwanted files if necessary.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CyberDanube
- Date Reserved
- 2026-08-04T11:34:48.629Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a7a297ebf8831d5396c850b
Added to database: 08/10/2026, 19:41:50 UTC
Last enriched: 08/10/2026, 19:56:20 UTC
Last updated: 09/25/2026, 01:47:38 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.