CVE-2025-24517: high-severity vulnerability in Inaba Denki Sangyo Co., Ltd.
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The CHOCO TEI WATCHER mini device relies on client-side authentication, allowing a remote attacker to obtain the login password without needing to authenticate first. This is a serious flaw because attackers can access the device without proper credentials.
CWE-603 Use of Client-Side Authentication vulnerability in CHOCO TEI WATCHER mini (IB-MCT001) allows unauthenticated remote attackers to extract the login password through client-side validation bypass. The attack vector is network-based with no authentication required; impact includes unauthorized administrative access to the device.
In the same product, most dangerous first.