The vulnerability is a resource exhaustion flaw in the TBEA TLogger V2.1.0.0B0.0.0.0 web server. An unauthenticated remote attacker can send HTTP PUT requests to the /tmp/ endpoint, causing the server to store the attacker‑controlled payload as persistent files under /opt/myapp/webserver/. Because the server then attempts to move these files to a directory that does not exist, the files remain and are never deleted. Repeating this behaviour rapidly consumes available storage, eventually exhausting disk space and leaving the web server unable to operate, resulting in a denial‑of‑service condition. The weakness is represented by CWE‑770, which describes uncontrolled resource consumption.

The affected product is TBEA TLogger 3rd Generation (TBEA Communication Box), specifically version V2.1.0.0B0.0.0.0. No other vendor versions were listed in the CVE entry, so the vulnerability applies to the supplied version only until a patch or newer release is made available.

The CVSS score of 8.7 conveys high severity, and the absence of an EPSS score means exploitation probability is not quantified but the flaw provides a straightforward remote attack path. Since the vendor has not listed the vulnerability in the CISA KEV catalog, there is no publicly confirmed active exploitation, but the lack of authentication renders the risk realistic for exposed systems. An attacker who can reach the web server over the network can repeatedly issue PUT requests to /tmp/ and overload the storage rapidly, possibly disrupting service for legitimate users.