CVE-2025-66357: Inaba Ib-mct001 Firmware DOS Vulnerability

CVE-2025-66357 Overview

CVE-2025-66357 affects the Inaba Denki Sangyo CHOCO TEI WATCHER mini (IB-MCT001), an industrial monitoring device used to detect momentary equipment stoppages on production lines. The vulnerability stems from an improper check for unusual or exceptional conditions [CWE-754] in the Video Download feature. When this feature enters a specific communication state, the device consumes resources abnormally, degrading availability. An unauthenticated attacker can trigger the condition remotely over the network without user interaction. The issue is tracked by JPCERT/CC under advisory JVNVU#92827367 and is documented in the Inaba vendor advisory.

Critical Impact
A remote, unauthenticated attacker can drive the IB-MCT001 device into abnormal resource consumption through the Video Download feature, resulting in a denial-of-service condition that interrupts factory-floor monitoring.

Affected Products

Inaba Denki Sangyo CHOCO TEI WATCHER mini (IB-MCT001) hardware
Inaba Denki Sangyo CHOCO TEI WATCHER mini (IB-MCT001) firmware (all versions listed in the vendor advisory)
Deployments exposing the device's web/video interface to reachable networks

Discovery Timeline

2025-12-16 - CVE-2025-66357 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66357

Vulnerability Analysis

The CHOCO TEI WATCHER mini exposes a Video Download feature that transfers recorded footage of production stoppages to operators. The firmware does not properly validate or handle exceptional communication states while this feature is active. When a client interacts with the download endpoint in a specific abnormal manner, the device fails to release or bound the associated resources. The result is unbounded consumption of memory, sockets, or processing capacity on the embedded device. Because the affected device is a compact industrial appliance with limited resources, exhaustion produces a rapid loss of monitoring availability. The confidentiality and integrity of stored video data are not directly affected by this flaw.

Root Cause

The root cause is an improper check for unusual or exceptional conditions [CWE-754]. The firmware's Video Download handler assumes well-formed client behavior and does not enforce guardrails such as connection timeouts, session accounting, or resource caps on abnormal states. When the communication deviates from expected patterns, the handler continues to allocate or hold resources rather than terminating the transaction cleanly.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker with network reachability to the device's Video Download interface issues requests that place the feature into the vulnerable communication state. Repeated or sustained triggering amplifies resource pressure and can render the device unresponsive until it is restarted. Attackers do not need to move laterally or chain other vulnerabilities to achieve impact.

No verified proof-of-concept code is publicly available. Refer to the JVN advisory JVNVU#92827367 for coordinated technical details.

Detection Methods for CVE-2025-66357

Indicators of Compromise

Unexpected reboots, watchdog resets, or unresponsiveness of IB-MCT001 devices during normal production hours
Sustained inbound connections to the device's Video Download endpoint from unfamiliar source addresses
Gaps in recorded video or missed stoppage-event captures coinciding with network activity spikes

Detection Strategies

Baseline normal request rates and session durations for the Video Download feature and alert on statistical deviations
Monitor network flows for repeated partial or long-lived sessions to the device that never complete a valid download
Correlate device availability telemetry with firewall logs to identify DoS-style traffic patterns targeting the appliance

Monitoring Recommendations

Enable syslog forwarding (where supported) from network segments hosting IB-MCT001 devices to a centralized log platform
Track ICMP and TCP reachability of each device on a short interval and alert on sustained loss
Review operational technology (OT) network segmentation logs for any traffic to the device that originates outside authorized engineering workstations

How to Mitigate CVE-2025-66357

Immediate Actions Required

Inventory all deployed CHOCO TEI WATCHER mini (IB-MCT001) devices and confirm firmware versions against the vendor advisory
Restrict network access to the device management and Video Download interfaces to trusted engineering hosts only
Apply firmware updates or mitigations published by Inaba Denki Sangyo as soon as they are available for your device revision
Prepare a device restart procedure so operators can quickly recover monitoring capability if the DoS condition is triggered

Patch Information

Inaba Denki Sangyo has published guidance in the official Chocomini vulnerability document. Coordinated details are also available in the JVN advisory JVNVU#92827367. Operators should follow the vendor's remediation instructions for their specific hardware and firmware revision.

Workarounds

Place IB-MCT001 devices behind a firewall or industrial DMZ that permits inbound access only from designated management workstations
Disable or restrict use of the Video Download feature where it is not required for operations
Implement rate limiting on upstream network devices to cap concurrent sessions reaching the appliance
Segment the device onto a dedicated OT VLAN with no direct exposure to corporate or internet-facing networks

bash

# Example: restrict access to the IB-MCT001 device to a single management host
# using an upstream Linux gateway (adjust interface and addresses to your environment)
iptables -A FORWARD -s 10.10.20.5/32 -d 10.20.30.40/32 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 10.20.30.40/32 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 10.20.30.40/32 -p tcp --dport 443 -j DROP