CVE-2025-24852mediumCWE-257

CVE-2025-24852: medium-severity vulnerability in Inaba Denki Sangyo Co., Ltd.

Published

Follow this CVE+ Monitor CHOCO TEI WATCHER mini

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.6epss 0.3%
In short

The device stores login passwords in a format that can be easily recovered from the microSD card. An attacker with physical access to the card can extract and read the password.

Technical detail

CWE-257 vulnerability in CHOCO TEI WATCHER mini (IB-MCT001) stores credentials in recoverable format on microSD card; exploitation requires physical access to the storage medium but enables direct password extraction without cryptographic operations.

Summary generated and translated by AI from the official description.
Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, an attacker who can access the microSD card used on the product may obtain the product login password.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Inaba Denki Sangyo Co., Ltd. · CHOCO TEI WATCHER mini (IB-MCT001)
Related CVEs — Inaba Denki Sangyo Co., Ltd.

In the same product, most dangerous first.

CVE-2025-26689CRITICALCVE-2025-26689EPSS 1.2%CVE-2025-25211CRITICALCVE-2025-25211EPSS 0.9%CVE-2025-24517HIGHCVE-2025-24517EPSS 0.8%CVE-2025-61976HIGHCVE-2025-61976EPSS 0.4%CVE-2025-66357MEDIUMCVE-2025-66357EPSS 0.3%CVE-2025-59479MEDIUMCVE-2025-59479EPSS 0.2%