CVE-2025-25211: CHOCO TEI Auth Bypass Vulnerability

CVE-2025-25211 Overview

CVE-2025-25211 is a weak password requirements vulnerability [CWE-521] affecting all versions of the CHOCO TEI WATCHER mini (IB-MCT001), a production-line monitoring camera manufactured by Inaba Denki Sangyo. The device enforces insufficient password complexity rules, allowing attackers to conduct brute-force attacks against the authentication interface. Successful exploitation grants unauthorized access to the device's management functions, which include live video feeds and recording controls used on factory floors.

Critical Impact

A remote, unauthenticated attacker can brute-force account credentials over the network and gain full access to the camera, exposing production-line surveillance footage and enabling tampering with recording functions.

Affected Products

• CHOCO TEI WATCHER mini (IB-MCT001) — all versions
• Inaba Denki Sangyo production-line monitoring cameras
• Industrial control system (ICS) deployments using IB-MCT001 for stoppage recording

Discovery Timeline

• 2025-03-31 - CVE-2025-25211 published to the National Vulnerability Database (NVD)
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-25211

Vulnerability Analysis

The IB-MCT001 device implements authentication without enforcing password complexity, length, or lockout controls sufficient to resist automated guessing. An attacker reaching the device over the network can iterate through credential candidates until valid authentication succeeds. Because the camera is typically deployed on operational technology (OT) segments to record production-line stoppages, compromise has direct operational consequences.

The issue is classified under [CWE-521: Weak Password Requirements]. Once authenticated, the attacker inherits administrative control over the device, with no secondary authorization layer to limit lateral activity within the device's web interface.

Root Cause

The firmware does not require users to set passwords meeting modern complexity standards and lacks compensating controls such as rate limiting, account lockout, or multi-factor authentication. This design choice leaves the authentication surface trivially attackable by credential-guessing tools.

Attack Vector

The attack is network-based and requires no prior privileges or user interaction. An attacker with reachability to the device's management interface, typically on TCP port 80/443 or the device's proprietary protocol, can submit automated authentication requests. Devices exposed to the internet or reachable from compromised IT segments are at highest risk. Refer to the CISA ICS Advisory ICSA-25-084-04 and JVN Vulnerability Report for vendor-confirmed attack surface details.

No verified public proof-of-concept code is available. The exploitation pattern follows standard credential brute-force methodology against the device's HTTP authentication endpoint, as described in the Nozomi Networks research.

Detection Methods for CVE-2025-25211

Indicators of Compromise

• Repeated failed HTTP authentication attempts to IB-MCT001 management interfaces from a single source within a short time window
• Successful logins from external or unexpected internal IP addresses to production-line camera endpoints
• Unscheduled configuration changes, firmware modifications, or new user accounts on the device
• Anomalous outbound traffic from the camera segment, indicating live video streaming to attacker-controlled hosts

Detection Strategies

• Deploy network intrusion detection signatures that flag high-frequency authentication failures against IB-MCT001 HTTP endpoints
• Correlate authentication logs against IT/OT boundary firewall flow records to identify unauthorized cross-zone access
• Baseline normal access patterns to the camera management interface and alert on deviations such as off-hours logins

Monitoring Recommendations

• Forward device and switch logs from the OT segment to a centralized SIEM for retention and correlation
• Monitor for new TCP sessions to IB-MCT001 from sources outside an explicit allowlist
• Track firmware version and configuration hashes to detect unauthorized modification post-compromise

How to Mitigate CVE-2025-25211

Immediate Actions Required

• Remove IB-MCT001 devices from direct internet exposure and place them behind a firewall on an isolated OT VLAN
• Change all default and weak passwords to long, unique values using the maximum complexity the device permits
• Restrict management interface access to a small set of administrative jump hosts using strict ACLs
• Review device logs for prior authentication anomalies that may indicate existing compromise

Patch Information

Refer to the vendor advisory Inaba ChocoMini Vulnerability PDF and CISA ICS Advisory ICSA-25-084-04 for the latest remediation guidance. At the time of advisory publication, the vulnerability affected all versions of IB-MCT001, and operators were directed to apply network-level mitigations pending vendor fixes.

Workarounds

• Segment production-line cameras onto a dedicated VLAN with no route to the internet or general corporate network
• Place a reverse proxy or VPN concentrator in front of the device to enforce strong authentication and rate limiting upstream
• Apply firewall rules permitting management traffic only from explicitly authorized engineering workstations
• Disable any unused network services and protocols on the device to reduce attack surface

# Configuration example: restrict access to IB-MCT001 management via iptables
# Allow management only from a dedicated jump host (192.0.2.10)
iptables -A FORWARD -s 192.0.2.10 -d 10.20.30.40 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s 192.0.2.10 -d 10.20.30.40 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.20.30.40 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 10.20.30.40 -p tcp --dport 443 -j DROP