CVE-2025-24852 Inaba Denki Sangyo Co., Ltd. CVE debrief

Who should care

OT/industrial operators, site administrators, and technicians who deploy, service, or physically handle CHOCO TEI WATCHER mini (IB-MCT001), especially where microSD cards are used.

Technical summary

The advisory states that access to the product's microSD card may allow an attacker to obtain the login password. This is a local/physical exposure scenario tied to removable media handling, not a network-side remote code execution issue. The supplied CVSS vector reflects physical attack complexity with high confidentiality impact and no integrity or availability impact.

Defensive priority

Medium. Prioritize controls that reduce physical access to the device and its microSD cards, and apply network containment measures where the product is exposed beyond a trusted LAN.

Recommended defensive actions

• Restrict the product operation, including the use and handling of microSD cards, to authorized users only.
• Use the product within a LAN and block access from untrusted networks and hosts through firewalls.
• If Internet access is required, place the product behind a firewall or VPN and restrict Internet access to the minimum necessary.
• Review physical access controls for the device, its storage media, and any maintenance workflows that involve the microSD card.
• Follow the linked CISA industrial control system recommended practices and the vendor/JVN guidance for additional hardening steps.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-084-04 and its source item, both published on 2025-03-25. The advisory description says an attacker who can access the microSD card used on the product may obtain the login password, and the remediation section recommends LAN containment, firewall/VPN use, and restricting microSD handling to authorized users. No vendor patch or fixed-version information is included in the supplied corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.