Use of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a remote attacker may obtain the product login password without authentication.

Use of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a remote attacker may obtain the product login password without authentication.

The affected product is vulnerable to a use of client-side authentication vulnerability, which may allow an attacker to obtain the product's login password without authentication. An attacker who can access the microSD card used on the product may obtain the product's login password. The affected product is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login. If a remote attacker sends a specially crafted HTTP request to the product, the product's data may be obtained or deleted, and/or the product's settings may be altered.

CHOCO TEI WATCHER mini provided by Inaba Denki Sangyo Co., Ltd. contains multiple vulnerabilities listed below. * Use of client-side authentication (CWE-603) - CVE-2025-24517 * Storing passwords in a recoverable format (CWE-257) - CVE-2025-24852 * Weak password requirements (CWE-521) - CVE-2025-25211 * Forced browsing (CWE-425) - CVE-2025-26689 Andrea Palanca of Nozomi Networks reported these vulnerabilities to the developer and CISA ICS. JPCERT/CC coordinated with the reporter, CISA ICS, and the developer.