CVE-2025-26689criticalCWE-425

CVE-2025-26689: critical vulnerability in Inaba Denki Sangyo Co., Ltd.

Published

Follow this CVE+ Monitor CHOCO TEI WATCHER mini

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.2%
In short

An attacker can directly access or delete data and change settings on CHOCO TEI WATCHER mini devices by sending specially crafted requests, without needing permission. This is a serious flaw because these devices are exposed to the internet and anyone could exploit it.

Technical detail

A Forced Browsing vulnerability (CWE-425) in CHOCO TEI WATCHER mini (IB-MCT001) all versions allows unauthenticated remote attackers to access, modify, or delete sensitive data and alter product configuration via direct HTTP requests. The vulnerability requires no authentication or user interaction and affects all versions of the product.

Summary generated and translated by AI from the official description.
Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote attacker sends a specially crafted HTTP request to the product, the product data may be obtained or deleted, and/or the product settings may be altered.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Inaba Denki Sangyo Co., Ltd. · CHOCO TEI WATCHER mini (IB-MCT001)
Related CVEs — Inaba Denki Sangyo Co., Ltd.

In the same product, most dangerous first.

CVE-2025-25211CRITICALCVE-2025-25211EPSS 0.9%CVE-2025-24517HIGHCVE-2025-24517EPSS 0.8%CVE-2025-61976HIGHCVE-2025-61976EPSS 0.4%CVE-2025-24852MEDIUMCVE-2025-24852EPSS 0.3%CVE-2025-66357MEDIUMCVE-2025-66357EPSS 0.3%CVE-2025-59479MEDIUMCVE-2025-59479EPSS 0.2%