QwikSec

Security Database

CVE

CWE

Training

CVE-2025-26689

Published: Mar 31, 2025

Modified: Mar 31, 2025

PUBLISHED

CVSS v3.1

9.8

CRITICAL

Description

Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote attacker sends a specially crafted HTTP request to the product, the product data may be obtained or deleted, and/or the product settings may be altered.

Vendor	Product	Versions
Inaba Denki Sangyo Co., Ltd.	CHOCO TEI WATCHER mini (IB-MCT001)	affected `all versions`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

https://www.inaba.co.jp/files/chocomini_vulnerability.pdf

https://jvn.jp/en/vu/JVNVU91154745/

https://www.cisa.gov/news-events/ics-advisories/icsa-25-084-04

https://www.nozominetworks.com/blog/unpatched-vulnerabilities-in-production-line-cameras-may-allow-remote-surveillance-hinder-stoppage-recording

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.