Multiple vulnerabilities in Mitsubishi Electric Air Conditioning System
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2021-20593 CVE-2021-20595 |
| CWE-ID | CWE-303 CWE-611 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
G-50A Hardware solutions / Firmware GB-50A Hardware solutions / Firmware AG-150A-A Hardware solutions / Firmware AG-150A-J Hardware solutions / Firmware GB-50ADA-A Hardware solutions / Firmware GB-50ADA-J Hardware solutions / Firmware EB-50GU-A Hardware solutions / Firmware EB-50GU-J Hardware solutions / Firmware AE-200A Hardware solutions / Firmware AE-200E Hardware solutions / Firmware AE-50A Hardware solutions / Firmware AE-50E Hardware solutions / Firmware EW-50A Hardware solutions / Firmware EW-50E Hardware solutions / Firmware TE-200A Hardware solutions / Firmware TE-50A Hardware solutions / Firmware TW-50A Hardware solutions / Firmware CMS-RMD-J Hardware solutions / Firmware PAC-YG50ECA Hardware solutions / Firmware GB-24A Hardware solutions / Firmware BAC-HD150 Hardware solutions / Firmware |
| Vendor | Mitsubishi Electric |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Incorrect Implementation of Authentication Algorithm
EUVDB-ID: #VU54511
Risk: Medium
CVSSv4.0: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-20593
CWE-ID:
CWE-303 - Incorrect Implementation of Authentication Algorithm
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain elevated privileges on the target system.
The vulnerability exists due to incorrect implementation of the authentication algorithm. A remote authenticated attacker can impersonate an administrator and tamper with information (e.g., operation information and configuration of the air conditioning system).
MitigationInstall updates from vendor's website.
Vulnerable software versionsG-50A: - - 3.35
GB-50A: - - 3.35
AG-150A-A: - - 3.20
AG-150A-J: - - 3.20
GB-50ADA-A: - - 3.20
GB-50ADA-J: - - 3.20
EB-50GU-A: - - 7.09
EB-50GU-J: - - 7.09
AE-200A: - - 7.93
AE-200E: - - 7.93
AE-50A: - - 7.93
AE-50E: - - 7.93
EW-50A: - - 7.93
EW-50E: - - 7.93
TE-200A: - - 7.93
TE-50A: - - 7.93
TW-50A: - - 7.93
CMS-RMD-J: - - 1.30
PAC-YG50ECA: - - 2.20
CPE2.3- cpe:2.3:h:mitsubishi_electric:g-50a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:g-50a:2.50:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:g-50a:3.35:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:gb-50a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:gb-50a:2.50:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:gb-50a:3.35:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ag-150a-a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ag-150a-a:3.20:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ag-150a-j:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ag-150a-j:3.20:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:gb-50ada-a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:gb-50ada-j:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:eb-50gu-a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:eb-50gu-j:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ae-200a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ae-200e:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ae-50a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ae-50e:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ew-50a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ew-50e:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:te-200a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:te-50a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:tw-50a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:cms-rmd-j:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:pac-yg50eca:*:*:*:*:*:*:*:*
https://ics-cert.us-cert.gov/advisories/icsa-21-182-04
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) XML External Entity injection
EUVDB-ID: #VU54512
Risk: High
CVSSv4.0: 6.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2021-20595
CWE-ID:
CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or perform a denial of service (DoS) attack.
Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.
MitigationInstall updates from vendor's website.
Vulnerable software versionsG-50A: - - 3.35
GB-50A: - - 3.35
GB-24A: - - 9.11
AG-150A-A: - - 3.20
AG-150A-J: - - 3.20
GB-50ADA-A: - - 3.20
GB-50ADA-J: - - 3.20
EB-50GU-A: - - 7.09
EB-50GU-J: - - 7.09
AE-200A: - - 7.93
AE-200E: - - 7.93
AE-50A: - - 7.93
AE-50E: - - 7.93
EW-50A: - - 7.93
EW-50E: - - 7.93
TE-200A: - - 7.93
TE-50A: - - 7.93
TW-50A: - - 7.93
CMS-RMD-J: - - 1.30
PAC-YG50ECA: - - 2.20
BAC-HD150: - - 2.21
CPE2.3- cpe:2.3:h:mitsubishi_electric:g-50a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:g-50a:3.35:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:gb-50a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:gb-50a:3.35:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:gb-24a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:gb-24a:9.11:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ag-150a-a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ag-150a-a:3.20:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ag-150a-j:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ag-150a-j:3.20:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:gb-50ada-a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:gb-50ada-j:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:eb-50gu-a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:eb-50gu-j:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ae-200a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ae-200e:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ae-50a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ae-50e:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ew-50a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:ew-50e:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:te-200a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:te-50a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:tw-50a:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:cms-rmd-j:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:pac-yg50eca:*:*:*:*:*:*:*:*
- cpe:2.3:h:mitsubishi_electric:bac-hd150:*:*:*:*:*:*:*:*
https://ics-cert.us-cert.gov/advisories/icsa-21-182-05
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
