Full Report
Nozomi Networks Labs recently identified vulnerabilities in the Inaba Denki Sangyo’s CHOCO TEI WATCHER mini (IB-MCT001) camera that... The post Unpatched vulnerabilities in Japan’s CHOCO TEI WATCHER Mini industrial cameras allow remote spying, production disruption appeared first on Industrial Cyber.
Analysis Summary
# Vulnerability: Unauthenticated Remote Access and Recording Disruption in Inaba Denki CHOCO TEI WATCHER mini
## CVE Details
- CVE ID: *Not explicitly provided in the text, implied multiple vulnerabilities exist.*
- CVSS Score: *Not explicitly provided in the text, described as "serious risks."*
- CWE: *Not explicitly provided in the text, inferred weaknesses include Improper Access Control (CWE-284) and possibly Path Traversal (CWE-22) due to forced browsing.*
## Affected Systems
- Products: Inaba Denki Sangyo CHOCO TEI WATCHER mini (IB-MCT001)
- Versions: Unpatched versions (specific version numbers not listed)
- Configurations: Any installation exposed to a network where an attacker can exchange packets with the device.
## Vulnerability Description
Multiple vulnerabilities (including plaintext credential extraction and forced browsing to sensitive API endpoints) exist in the CHOCO TEI WATCHER mini (IB-MCT001) camera, which is used for monitoring and analyzing production stoppages via the browser-based CHOCO TEI VIEWER. These flaws allow an unauthenticated, remote attacker to bypass login, gain unauthorized access to the device, remotely access live video and audio feeds for surveillance, or disrupt/delete recordings of production line stoppages. One vulnerability (CVE-2025-24852, implied) requires physical access to the microSD card.
## Exploitation
- Status: PoC available (Implied by the detailed researcher findings, but not explicitly stated as public PoC) - *Assessing risk based on description: High potential for exploitation.*
- Complexity: Low (Can be executed remotely without valid credentials or user interaction over the network).
- Attack Vector: Network (Remote), Physical (for microSD-related flaw).
## Impact
- Confidentiality: High (Remote covert surveillance, extraction of plaintext credentials).
- Integrity: High (Ability to manipulate or delete critical diagnostic footage).
- Availability: Medium (Potential for disruption of root-cause analysis, leading to prolonged downtime).
## Remediation
### Patches
- Patches: **None available** from the vendor at the time of reporting.
### Workarounds
The vendor and researchers strongly recommend the following network segmentation and access control measures:
1. **Network Isolation:** Deploy the product strictly within a secured LAN.
2. **Firewalling:** Block all external access from untrusted networks and hosts using firewalls.
3. **Restricted Remote Access:** If Internet access is strictly required, enforce access only through a Virtual Private Network (VPN) and strong authentication.
4. **Principle of Least Privilege:** Restrict Internet access to the absolute minimum required for function.
5. **Physical Security:** Restrict physical access to authorized personnel only. Secure the product's microSD card, as it cannot be encrypted, to prevent unauthorized removal or tampering.
## Detection
- Indicators of Compromise: Unexplained monitoring of live feeds, unusual deletion or alteration of stored stoppage recordings, external connections flagged by the firewall/IDS targeting the device management interface.
- Detection methods and tools: Enable logging and intrusion detection systems (IDS) to monitor connection attempts and activity on the device's management web application. Regular security monitoring of the internal network traffic directed toward the IB-MCT001 is crucial.
## References
- Vendor Advisories: CISA ICS Advisory ICSA-25-084-04
- Relevant links - defanged:
- Nozomi Networks Research Post: industrialcyber[.]co/vndrs/nozomi-networks/
- CISA Advisory: cisa[.]gov/news-events/ics-advisories/icsa-25-084-04