Most recent entries from all

bdu:2025-04969

EUVD-2026-226261

fkie_cve-2025-26689

Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote attacker sends a specially crafted HTTP request to the product, the product data may be obtained or deleted, and/or the product settings may be altered.

GHSA-3p6f-jvp3-w6pm

ICSA-25-084-04 — Inaba Denki Sangyo CHOCO TEI WATCHER mini

The affected product is vulnerable to a use of client-side authentication vulnerability, which may allow an attacker to obtain the product's login password without authentication. An attacker who can access the microSD card used on the product may obtain the product's login password. The affected product is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login. If a remote attacker sends a specially crafted HTTP request to the product, the product's data may be obtained or deleted, and/or the product's settings may be altered.

jvndb-2025-002592

CHOCO TEI WATCHER mini provided by Inaba Denki Sangyo Co., Ltd. contains multiple vulnerabilities listed below. * Use of client-side authentication (CWE-603) - CVE-2025-24517 * Storing passwords in a recoverable format (CWE-257) - CVE-2025-24852 * Weak password requirements (CWE-521) - CVE-2025-25211 * Forced browsing (CWE-425) - CVE-2025-26689 Andrea Palanca of Nozomi Networks reported these vulnerabilities to the developer and CISA ICS. JPCERT/CC coordinated with the reporter, CISA ICS, and the developer.