CVE-2025-24852

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, an attacker who can access the microSD card used on the product may obtain the product login password.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-257

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-248537.5A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript CVE-2025-248546.1A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to CVE-2025-248557.8numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but neve CVE-2025-248564.2An issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. The account linking logic allows a CVE-2025-248577.6Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019 CVE-2025-248588.3Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashe CVE-2025-248598.8A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated afte CVE-2025-24868.8The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing byp CVE-2025-248605.4Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to CVE-2025-248619.8An attacker may inject commands via specially-crafted post requests.CVE-2025-248622.0Unrestricted upload of file with dangerous type for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applic CVE-2025-248636.5Improper privilege management for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow a