Incorrect Implementation of Authentication Algorithm in Mitsubishi Electric products - CVE-2021-20593

Vulnerability identifier: #VU54511

CSH Severity: Medium

CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20593

CWE-ID: CWE-303

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The vulnerability exists due to incorrect implementation of the authentication algorithm. A remote authenticated attacker can impersonate an administrator and tamper with information (e.g., operation information and configuration of the air conditioning system).

GB-50ADA-A
AE-200E
AE-50A
AE-200A
AE-50E
EB-50GU-J
EW-50A
EB-50GU-A
EW-50E
GB-50ADA-J
TE-200A
TE-50A
AG-150A-J
TW-50A
AG-150A-A
CMS-RMD-J
GB-50A
PAC-YG50ECA
G-50A

Install updates from vendor's website.

GB-50ADA-A - update to 3.21
AE-200E - update to 7.95
AE-50A - update to 7.95
AE-200A - update to 7.95
AE-50E - update to 7.95
EB-50GU-J - update to 7.10
EW-50A - update to 7.95
EB-50GU-A - update to 7.10
EW-50E - update to 7.95
GB-50ADA-J - update to 3.21
TE-200A - update to 7.95
TE-50A - update to 7.95
AG-150A-J - update to 3.21
TW-50A - update to 7.95
AG-150A-A - update to 3.21
CMS-RMD-J - update to 1.40
GB-50A - update to 3.37
PAC-YG50ECA - update to 2.21
G-50A - update to 3.37

• https://ics-cert.us-cert.gov/advisories/icsa-21-182-04

• Multiple vulnerabilities in Mitsubishi Electric Air Conditioning System