CVE-2025-59479

MediumCVSS 6.1/10Last modified Oct 7, 2026

Description

CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper restriction of rendered UI layers or frames. If a user clicks on content on a malicious web page while logged into the product, unintended operations may be performed on the product.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
Inaba Denki Sangyo Co., Ltd.	CHOCO TEI WATCHER mini (IB-MCT001)	all versions

References

https://jvn.jp/en/vu/JVNVU92827367/Third Party Advisory
https://www.inaba.co.jp/files/chocomini_vulnerability_newly_identified.pdfVendor Advisory

Timeline

Published: Dec 16, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-59489.8The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and inclu CVE-2025-594806.5Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious CVE-2025-594818.7A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at CVE-2025-594828.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-594836.5A validation vulnerability exists in an undisclosed URL in the Configuration utility. Note: Software versions which have reached End of Tec CVE-2025-594848.3The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies CVE-2025-594854.8Incorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an CVE-2025-594878.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-594897.4Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code f CVE-2025-59498.8The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and inclu CVE-2025-594916.1Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields.CVE-2025-594947.8Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.