SB2025040715 - Multiple vulnerabilities in Inaba Denki Sangyo products
Published: April 7, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Incorrect Privilege Assignment (CVE-ID: CVE-2025-23407)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to incorrect privilege assignment in the WEB UI (the setting page). A remote user can alter the settings without appropriate privileges.
2) OS Command Injection (CVE-ID: CVE-2025-25053)
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation in the WEB UI (the setting page). A remote user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Cross-site request forgery (CVE-ID: CVE-2025-25056)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
4) Improper Restriction of Rendered UI Layers or Frames (CVE-ID: CVE-2025-25213)
The vulnerability allows a remote attacker to compromsie the target system.
The vulnerability exists due to improper restriction of rendered UI layers or frames. A remote attacker can trick a victim to perform operations on the product's web pages.
5) Cleartext transmission of sensitive information (CVE-ID: CVE-2025-27722)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to software uses insecure communication channel to transmit sensitive information. A remote attacker with ability to intercept network traffic can gain access to sensitive data.
6) OS Command Injection (CVE-ID: CVE-2025-27797)
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation in the specific service. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2025-27934)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in the specific service. A remote attacker can obtain the product authentication information.
8) Missing Authentication for Critical Function (CVE-ID: CVE-2025-29870)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to missing authentication for critical function. A remote attacker can obtain the product configuration information including authentication information.
Remediation
Install update from vendor's website.