XML External Entity injection in Mitsubishi Electric products - CVE-2021-20595

Vulnerability identifier: #VU54512

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N]

CVE-ID: CVE-2021-20595

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or perform a denial of service (DoS) attack.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

EB-50GU-A
EW-50E
TE-200A
EW-50A
TE-50A
AE-50E
TW-50A
AE-50A
CMS-RMD-J
AE-200E
AE-200A
PAC-YG50ECA
EB-50GU-J
GB-50ADA-J
GB-50ADA-A
AG-150A-J
AG-150A-A
BAC-HD150
GB-24A
GB-50A
G-50A

Install updates from vendor's website.

EB-50GU-A - update to 7.10
EW-50E - update to 7.95
TE-200A - update to 7.95
EW-50A - update to 7.95
TE-50A - update to 7.95
AE-50E - update to 7.95
TW-50A - update to 7.95
AE-50A - update to 7.95
CMS-RMD-J - update to 1.40
AE-200E - update to 7.95
AE-200A - update to 7.95
PAC-YG50ECA - update to 2.21
EB-50GU-J - update to 7.10
GB-50ADA-J - update to 3.21
GB-50ADA-A - update to 3.21
AG-150A-J - update to 3.21
AG-150A-A - update to 3.21
BAC-HD150 - update to 2.22
GB-24A - update to 9.12
GB-50A - update to 3.37
G-50A - update to 3.37

• https://ics-cert.us-cert.gov/advisories/icsa-21-182-05

• Multiple vulnerabilities in Mitsubishi Electric Air Conditioning System