TL;DR: TBEA TLogger Communication Box 3rd Generation ships with a hard-coded root account credential. An unauthenticated remote attacker can recover the password from the device's /etc/shadow file and use it to log in via SSH with full administrative access. The affected firmware version is V2.1.0.0B0.0.0.0, and no fix has been released.

What happened

The TBEA TLogger Communication Box 3rd Generation, firmware V2.1.0.0B0.0.0.0, contains a default root account baked into the device image. The root password is stored as a hash in /etc/shadow. Because the hash is derivable from the firmware, anyone who gets their hands on the firmware can crack it offline and recover the plaintext password.

Once recovered, the credential works against the SSH service exposed on the device. No authentication bypass is needed. The attacker simply logs in as root. The vulnerability is classified as CWE-799 (Improper Control of Interaction Frequency) combined with CWE-798 (Use of Hard-coded Credentials).

This is not a misconfiguration that a deployer introduced. The credential ships in the firmware itself. Every device running this version has the same root password. Removing or changing the password requires firmware modification, which most operators of industrial communication boxes would never attempt.

Who is affected

TBEA ( Beijing TBEA Information Technology Co., Ltd.) is a subsidiary of TBEA Co., Ltd., one of China's largest manufacturers of transformers and power transmission equipment. The TLogger Communication Box is deployed in industrial settings for remote monitoring and data acquisition across power infrastructure, including substations, transmission lines, and renewable energy installations.

The affected product is the TBEA TLogger Communication Box 3rd Generation running firmware V2.1.0.0B0.0.0.0. No fixed firmware version is listed in the advisory. The update URL field is empty. Operators running this firmware version are exposed, and no vendor patch exists as of publication.

TBEA TLogger devices sit on SCADA and industrial control networks. A root SSH session on one of these boxes gives an attacker a foothold inside the operational technology environment. From there, lateral movement to PLCs, RTUs, and other field devices becomes possible.

What to do

There is no vendor patch. The advisory lists no fixed versions. Operators should take these measures immediately:

• Restrict network access to the TBEA TLogger SSH service. Place the device behind a firewall that only permits SSH from a dedicated management VLAN or jump host.
• Audit /etc/shadow on each device. If the root password hash matches the known default, change the root password to a strong, unique value. Document the change.
• Monitor SSH login attempts on affected devices. Forward authentication logs to a SIEM or network monitoring tool.
• Contact TBEA support to request a patched firmware version. Track this advisory for vendor updates.

Do not assume a changed password resolves the issue permanently. A firmware reflash or factory reset will restore the default credential. Operators need a process for re-verifying the root password after any maintenance event.

Why it matters

Hardcoded credentials in industrial IoT devices are a recurring problem. The same class of flaw affected millions of devices in the Mirai botnet attacks of 2016. Industrial communication boxes deployed in power infrastructure carry higher stakes than consumer IoT. A compromised TLogger gives an attacker a persistent root shell inside the OT network.

This CVE was published on August 10, 2026 and is not yet in CISA's Known Exploited Vulnerabilities catalog. No EPSS score is available, and NVD has not assigned a CVSS vector. Given that authentication is trivial (the password is known) and network access to the SSH service is often broader than realized in industrial environments, the practical risk is high even without a formal severity rating.

Five additional CVEs were disclosed for the same TBEA TLogger device on the same date, including unauthenticated SQL injection (CVE-2025-13294), authentication bypass (CVE-2025-15681), and multiple denial-of-service conditions (CVE-2025-15683, CVE-2025-15682). The device has systemic security problems. Operators should treat the entire platform as untrusted until TBEA releases patched firmware.

References

• CVE-2025-13293 on hol.org
• NVD entry: pending (CVE submitted to CVE List V5 on August 10, 2026)
• Related: CVE-2025-13294 (SQL injection), CVE-2025-15681 (auth bypass), CVE-2025-15682, CVE-2025-15683 (DoS), CVE-2025-15680 (UART info disclosure)