CVE-2025-15682: TBEA TLogger DoS Vulnerability

CVE-2025-15682 Overview

CVE-2025-15682 is an unauthenticated resource exhaustion vulnerability in TBEA TLogger V2.1.0.0B0.0.0.0. The embedded web server accepts unauthenticated PUT requests targeting the /tmp/ endpoint. Each request creates a persistent file containing attacker-controlled data under /opt/myapp/webserver/. The web server then attempts to move the file into a non-existent directory, so cleanup fails and the files remain on disk. Repeated requests exhaust available storage and produce a denial-of-service condition. The weakness is classified as [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
An unauthenticated remote attacker can fill the device filesystem with attacker-controlled files, causing persistent denial of service on the TLogger web server.

Affected Products

TBEA TLogger V2.1.0.0B0.0.0.0
TBEA TLogger V2 series web server component
Deployments exposing the TLogger web interface on reachable networks

Discovery Timeline

2026-08-10 - CVE-2025-15682 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2025-15682

Vulnerability Analysis

The TLogger web server exposes an HTTP PUT handler on the /tmp/ endpoint without authentication. When a client submits a PUT request, the server writes the request body to a file under /opt/myapp/webserver/. The handler was designed to relocate the newly written file to a staging directory as part of normal processing.

The destination directory does not exist on the target filesystem. The move operation fails silently, and the source file is never deleted or truncated. Every successful PUT therefore leaves an additional attacker-controlled artifact on persistent storage. Because there is no size limit, request throttling, or per-client quota, an attacker can loop PUT requests until the underlying volume is full.

Root Cause

The root cause is missing resource enforcement combined with a broken cleanup path. The web server does not validate the caller, does not cap upload size, and does not verify that the post-write move succeeds. The absent target directory converts a transient staging step into permanent file retention, so ordinary web traffic becomes disk-consuming state.

Attack Vector

Exploitation requires only network access to the TLogger web service. No credentials, tokens, or user interaction are needed. An attacker issues repeated PUT requests to /tmp/ with arbitrary payload bodies. Each request enlarges the on-disk footprint under /opt/myapp/webserver/ until logging, telemetry, and the web server itself fail due to lack of free space. Recovery requires manual filesystem cleanup on the affected device.

No verified public proof-of-concept code is available at time of writing. See the TBEA Company Overview for vendor context.

Detection Methods for CVE-2025-15682

Indicators of Compromise

Unexpected file growth under /opt/myapp/webserver/ on TLogger devices
Repeated inbound HTTP PUT requests targeting the /tmp/ URI on the TLogger web server
Rapidly declining free space on the TLogger root or application volume
Web server, logging, or telemetry failures correlated with disk-full conditions

Detection Strategies

Alert on any HTTP PUT method reaching the TLogger /tmp/ endpoint from untrusted networks
Monitor filesystem usage on TLogger appliances and flag sustained growth in /opt/myapp/webserver/
Baseline normal request volume to the TLogger web server and alert on sudden increases from a single source

Monitoring Recommendations

Forward web server access logs to a central SIEM and retain method, URI, source IP, and payload size fields
Track free space and inode counts on TLogger devices with threshold alerts well below full capacity
Correlate spikes in PUT traffic with disk-usage growth to distinguish exploitation from benign upload patterns

How to Mitigate CVE-2025-15682

Immediate Actions Required

Restrict network access to the TLogger web server so only trusted management hosts can reach it
Block or rate-limit HTTP PUT requests to the /tmp/ endpoint at an upstream firewall or reverse proxy
Inspect /opt/myapp/webserver/ on affected devices and remove attacker-planted files to restore free space
Contact TBEA for a fixed firmware release or vendor-approved configuration guidance

Patch Information

No vendor patch reference is listed in the published CVE record. Operators should track TBEA advisories and apply firmware updates as they become available. Until a fix is issued, treat network-layer restrictions as the primary control.

Workarounds

Place the TLogger web server behind a reverse proxy that enforces authentication and denies the PUT method
Apply per-source connection and request rate limits to prevent sustained upload floods
Segment TLogger devices onto an isolated OT or management VLAN with strict access control lists
Monitor disk utilization and automate alerting when free space drops below an operational threshold

bash

# Example upstream nginx configuration to block unauthenticated PUT to /tmp/
location /tmp/ {
    limit_except GET HEAD {
        deny all;
    }
    limit_req zone=tlogger burst=5 nodelay;
    client_max_body_size 16k;
}