CVE-2025-59479: medium-severity vulnerability in Inaba Denki Sangyo Co., Ltd.
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The CHOCO TEI WATCHER mini device can be tricked into performing unwanted actions if you click on content from a malicious website while logged in. This happens because the device doesn't properly protect its interface from being controlled by external pages.
The device suffers from improper UI layer restriction (CWE-1021), allowing cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by an authenticated user, executes unintended operations on the device through clickjacking or frame-based attacks without explicit user consent on the target interface.
In the same product, most dangerous first.