CVE-2025-24852: CHOCO TEI WATCHER mini Password Disclosure

CVE-2025-24852 Overview

CVE-2025-24852 is a credential storage weakness in the Inaba Denki Sangyo CHOCO TEI WATCHER mini (IB-MCT001), a production-line monitoring camera. All versions store the product login password in a recoverable format on the microSD card used by the device. An attacker with physical access to the microSD card can extract and recover the login password. The issue is tracked under CWE-257: Storing Passwords in a Recoverable Format and is documented in CISA ICS Advisory ICSA-25-084-04 and the JVN Vulnerability Report.

Critical Impact

Physical access to the microSD card allows recovery of the device login password, enabling unauthorized access to the camera and its recorded footage.

Affected Products

• CHOCO TEI WATCHER mini (IB-MCT001) — all versions
• Inaba Denki Sangyo production-line monitoring cameras
• Deployments using microSD storage for configuration and recorded data

Discovery Timeline

• 2025-03-31 - CVE-2025-24852 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24852

Vulnerability Analysis

The CHOCO TEI WATCHER mini (IB-MCT001) writes the device login password to the microSD card in a format that is reversible to plaintext. Recoverable password storage means the credential is either encoded, obfuscated, or encrypted with a key that can be recovered from the device or its media. An attacker who removes the microSD card and reads its contents can reconstruct the login password without brute forcing a cryptographic hash.

Once recovered, the password grants access to the camera's web interface and recorded footage. The Nozomi Networks research on production-line camera vulnerabilities describes how compromised cameras of this class can be used for unauthorized surveillance, footage tampering, and disruption of stoppage recording used in manufacturing quality assurance.

Root Cause

The root cause is a design decision to persist authentication material in a format that supports recovery rather than one-way hashing with a salt. Password verification schemes should compare a hash of the submitted password against a stored hash, never reversing stored data back to plaintext. The Inaba vulnerability document confirms the storage behavior across all versions.

Attack Vector

Exploitation requires physical possession of the microSD card. The attacker removes the card from the device, mounts it on a workstation, locates the credential artifact, and applies the recovery process implied by the storage format. No network access, user interaction, or prior authentication to the camera is required. Because the attack vector is physical, exposure is highest in facilities where cameras are mounted in reachable locations or where discarded, replaced, or shipped media is not sanitized.

No verified exploit code is publicly available for CVE-2025-24852. See the JVN report for the coordinated disclosure details.

Detection Methods for CVE-2025-24852

Indicators of Compromise

• Unexplained removal, reinsertion, or replacement of microSD cards in IB-MCT001 devices.
• Successful web interface logins to the camera from unfamiliar workstations or off-hours sessions.
• Configuration changes, firmware settings modifications, or recording gaps that do not match maintenance records.

Detection Strategies

• Correlate physical access logs, door badge events, and CCTV coverage of camera locations with any change in camera state or card status.
• Monitor the camera management network segment for authentication events and flag logins from IP addresses outside the approved operations range.
• Track chain-of-custody for any microSD card removed from an IB-MCT001, including RMA returns and decommissioned units.

Monitoring Recommendations

• Forward camera authentication and configuration logs to a centralized SIEM or data lake for retention and alerting.
• Alert on repeated failed logins followed by a successful login on IB-MCT001 devices.
• Review network flows from OT segments hosting these cameras to detect unexpected outbound connections that may indicate post-compromise activity.

How to Mitigate CVE-2025-24852

Immediate Actions Required

• Restrict physical access to CHOCO TEI WATCHER mini (IB-MCT001) devices and their microSD cards using locked enclosures or tamper-evident seals.
• Change the device login password on any unit whose microSD card may have left controlled custody.
• Sanitize or destroy microSD cards before disposal, RMA return, or reassignment.

Patch Information

At the time of NVD publication, the CISA ICS Advisory ICSA-25-084-04 and the Inaba vulnerability document indicate that all versions of IB-MCT001 are affected. Consult the vendor advisory for the latest guidance on firmware updates or product replacement, and apply vendor-supplied remediation as soon as it becomes available.

Workarounds

• Place IB-MCT001 devices behind physical barriers that prevent unauthorized microSD card removal.
• Segment the camera management network from corporate and internet-facing networks to limit the value of a recovered password.
• Use unique, high-entropy passwords per device so that recovery of one credential does not compromise the fleet.
• Maintain an inventory of deployed IB-MCT001 units and their microSD cards to detect swaps or losses promptly.