CVE-2025-66357
📋 TL;DR
The CHOCO TEI WATCHER mini (IB-MCT001) has an improper condition check vulnerability in its Video Download feature that can cause abnormal resource consumption when in a specific communication state. This affects all users of the IB-MCT001 device who use the Video Download functionality. The vulnerability could lead to denial of service or device instability.
💻 Affected Systems
- CHOCO TEI WATCHER mini (IB-MCT001)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device resource exhaustion leading to denial of service, device crash, or inability to perform normal functions until reboot.
Likely Case
Degraded device performance, video download failures, and intermittent service disruptions.
If Mitigated
Minimal impact with proper network segmentation and monitoring in place.
🎯 Exploit Status
Exploitation requires triggering specific communication state in Video Download feature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific firmware version
Vendor Advisory: https://www.inaba.co.jp/files/chocomini_vulnerability_newly_identified.pdf
Restart Required: Yes
Instructions:
1. Download latest firmware from Inaba official website
2. Follow device firmware update procedure
3. Reboot device after update completes
4. Verify firmware version is updated
🔧 Temporary Workarounds
Disable Video Download Feature
allTemporarily disable the Video Download functionality to prevent triggering the vulnerability
Network Segmentation
allIsolate device on separate VLAN with restricted network access
🧯 If You Can't Patch
- Isolate device from untrusted networks
- Implement rate limiting on device communications
- Monitor device resource usage for anomalies
🔍 How to Verify
Check if Vulnerable:
Check device firmware version against vendor advisory. If using unpatched version, device is vulnerable.Check Version:
Check device web interface or console for firmware version informationVerify Fix Applied:
Verify firmware version matches patched version from vendor advisory and test Video Download functionality.📡 Detection & Monitoring
Log Indicators:
- Abnormal resource consumption logs
- Video Download process failures
- Device restart events
Network Indicators:
- Unusual network traffic patterns to/from device
- Repeated connection attempts to Video Download service
SIEM Query:
Search for: device_model:"IB-MCT001" AND (event_type:"resource_exhaustion" OR process:"video_download")