Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated attacker to use the product as an intermediary for FTP bounce attack.

Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated attacker to use the product as an intermediary for FTP bounce attack.

HMI ViewJet C-more series and HMI GC-A2 series provided by JTEKT ELECTRONICS CORPORATION contain multiple vulnerabilities listed below. <ul> <li>Improper Restriction of Rendered UI Layers or Frames (CWE-1021) - CVE-2025-24310</li> <li>Allocation of Resources Without Limits or Throttling (CWE-770) - CVE-2025-24317</li> <li>Unintended Proxy or Intermediary (&#39;Confused Deputy&#39;) (CWE-441) - CVE-2025-25061</li> <li>Weak Encoding for Password (CWE-261) - CVE-2025-26401</li> </ul> JTEKT ELECTRONICS CORPORATION reported these vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and JTEKT ELECTRONICS CORPORATION coordinated under the Information Security Early Warning Partnership.