CVE-2025-13294: Unauthenticated SQL Injection
An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploit these endpoints to read, modify, or delete data stored in the device's CCU.db database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13294?
The severity of CVE-2025-13294 is rated at 71, indicating a critical risk level due to unauthenticated SQL injection.
How do I fix CVE-2025-13294?
To fix CVE-2025-13294, apply security patches provided by TBEA or ensure that input parameters in SQLite queries are properly validated and parameterized.
Who can be impacted by CVE-2025-13294?
Any user or organization operating TBEA TLogger V2.1.0.0B0.0.0.0 may be impacted by CVE-2025-13294 as it allows unauthenticated remote attacks.
What types of attacks can exploit CVE-2025-13294?
CVE-2025-13294 can be exploited by attackers to perform unauthorized data manipulation or retrieval from the SQLite database.
Is authentication required to exploit CVE-2025-13294?
No, CVE-2025-13294 can be exploited by an unauthenticated attacker, making it particularly dangerous.