CVE-2025-66357
BaseFortify
Publication date: 2025-12-16
Last updated on: 2025-12-23
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| inaba | ib-mct001_firmware | * |
| inaba | ib-mct001 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-754 | The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-66357 is a vulnerability in the CHOCO TEI WATCHER mini (IB-MCT001) where the Video Download feature, when in a specific communication state, causes abnormal consumption of the product's resources. This happens due to an improper check for unusual or exceptional conditions, which can lead to communication delays and an infinite loop of error file downloads. [1, 2]
How can this vulnerability impact me? :
This vulnerability can cause the device to consume resources abnormally, potentially leading to system unresponsiveness or degraded performance. Remote attackers can exploit this by sending crafted requests to the Video Download interface, causing communication delays and infinite error loops, which may disrupt normal device operation. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting the use of the CHOCO TEI WATCHER mini device to trusted LAN environments, limiting access from untrusted networks or hosts, employing firewalls or Virtual Private Networks (VPNs) to prevent unauthorized access when connecting the device to the internet, and minimizing the scope of internet exposure. Users should also refer to the product manual for detailed configuration changes. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability CVE-2025-66357 involves abnormal resource consumption when the Video Download feature is in a specific communication state, causing communication delays and an infinite loop of error file downloads. Detection can focus on monitoring unusual network traffic patterns related to the Video Download feature, such as repeated or looping download requests causing high resource usage. Since the vulnerability is triggered remotely via crafted requests to the Video Download interface, network monitoring tools could be used to detect abnormal repeated requests or communication delays. Specific commands are not provided in the available resources. Recommended mitigation includes restricting device use to trusted LAN environments, limiting access from untrusted networks, and using firewalls or VPNs to prevent unauthorized access. [1, 2]