CVE-2025-61976: Inaba IB-MCT001 Firmware DoS Vulnerability

CVE-2025-61976 Overview

CVE-2025-61976 affects the Inaba Denki Sangyo CHOCO TEI WATCHER mini (IB-MCT001), an industrial monitoring device used to detect momentary equipment stoppages. The vulnerability stems from an improper check for unusual or exceptional conditions [CWE-754] in the device's Video Download interface. A remote, unauthenticated attacker can send a specially crafted request to that interface and cause the device to become unresponsive. The flaw is reachable over the network without privileges or user interaction, making it well-suited to disruption of monitoring operations on factory floors.

Critical Impact
Unauthenticated network attackers can render the CHOCO TEI WATCHER mini unresponsive by sending a crafted request to the Video Download interface, disrupting monitoring of production equipment.

Affected Products

Inaba Denki Sangyo CHOCO TEI WATCHER mini (IB-MCT001) hardware
Inaba Denki Sangyo IB-MCT001 firmware (all versions listed in the advisory)
Deployments exposing the Video Download interface to reachable networks

Discovery Timeline

2025-12-16 - CVE-2025-61976 published to the National Vulnerability Database
2025-12-23 - Last updated in the NVD database

Technical Details for CVE-2025-61976

Vulnerability Analysis

The defect lives in the Video Download interface exposed by the CHOCO TEI WATCHER mini. The handler does not properly validate or handle unusual input conditions when processing download requests. A crafted request triggers an exceptional condition that the firmware fails to recover from, leaving the device in an unresponsive state.

Because the device monitors short-duration equipment stoppages ("choco-tei") on production lines, an outage of the watcher itself can mask real production faults. Recovery typically requires a physical or administrative power cycle, which extends operational impact beyond the duration of the attack itself. The issue is mapped to [CWE-754]: Improper Check for Unusual or Exceptional Conditions.

Root Cause

The Video Download endpoint accepts requests whose structure or parameters fall outside expected ranges without enforcing defensive checks. When such a request is parsed, the firmware enters an error path that is not handled gracefully, leading to a hang or crash of the service that ultimately renders the unit unresponsive.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker with reachability to the device's HTTP interface issues a single malformed request to the Video Download endpoint. The vulnerability affects availability only; it does not provide code execution, data disclosure, or integrity impact according to the published CVSS metrics.

No public proof-of-concept code or in-the-wild exploitation has been reported. Refer to the JVN Security Advisory and the Inaba ChocoMini Vulnerability Report for vendor-provided technical detail.

Detection Methods for CVE-2025-61976

Indicators of Compromise

Unscheduled unresponsiveness of IB-MCT001 units, especially loss of web UI or video access following inbound HTTP traffic.
HTTP requests to the Video Download interface originating from unexpected source addresses, including any non-engineering subnet.
Repeated power cycles or watchdog resets logged on affected devices without a corresponding maintenance change.

Detection Strategies

Monitor network traffic to the device for malformed or oversized requests targeting the Video Download URL path.
Use ICMP or application-layer health checks against IB-MCT001 units and alert on transitions to unresponsive states.
Correlate availability loss of monitoring devices with production-line telemetry gaps to identify suspicious patterns.

Monitoring Recommendations

Forward network logs from the operational technology (OT) segment hosting the device into a SIEM for inspection of HTTP requests to the watcher's interface.
Track the device's reachability with periodic synthetic probes and alert security and OT teams jointly on unexpected downtime.
Capture packet samples from any host attempting to access the Video Download endpoint to support incident triage.

How to Mitigate CVE-2025-61976

Immediate Actions Required

Restrict network access to IB-MCT001 devices to a defined set of management workstations using firewall or VLAN access control lists.
Place the watcher devices behind an OT-aware firewall and block inbound HTTP requests from IT and external networks.
Audit current exposure of the Video Download interface and disable remote access where it is not operationally required.

Patch Information

Review the vendor advisory at the Inaba ChocoMini Vulnerability Report and the JVN Security Advisory for the latest firmware updates and remediation guidance. Apply vendor-provided firmware as soon as it is released for your hardware revision, and validate the update in a controlled environment before broad deployment.

Workarounds

Segment the OT network so that IB-MCT001 units are not reachable from corporate IT or the internet.
Require VPN or jump-host access for any administrative interaction with the device's web interface.
Establish a manual recovery procedure, such as documented power-cycle steps, to reduce downtime if a device becomes unresponsive.

bash

# Example firewall rule restricting access to the IB-MCT001 management interface
# Replace <mgmt_host> and <device_ip> with site-specific values
iptables -A FORWARD -p tcp -s <mgmt_host> -d <device_ip> --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d <device_ip> --dport 80 -j DROP