CVE-2025-15683 describes multiple unauthenticated denial-of-service vulnerabilities in TBEA TLogger (TBEA Communication Box 3rd Generation) version 2.1.0.0B0.0.0.0. The vulnerabilities arise from missing authentication on critical functions exposed via HTTP endpoints such as onRestart, onReset, ClearData, and others. Attackers can invoke these endpoints remotely without credentials to reboot or reset the device, clear application data, or crash the web server by triggering segmentation faults. Unsafe string operations like sprintf() and strcat() without proper bounds checking allow crafted inputs to cause buffer overflows leading to crashes. The CVSS 4.0 score is 8.8 (high severity), reflecting network attack vector, no privileges or user interaction required, and high impact on integrity and availability.

An unauthenticated remote attacker can cause denial of service by rebooting or resetting the device, clearing application data, or crashing the web server. This disrupts device availability and may impact operational continuity. There is no indication of confidentiality or privilege escalation impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device's web server to trusted administrators only to prevent unauthenticated access to critical endpoints.