High severity · published Jul 13, 2021
CVE-2021-20595
Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.3.35 and prior, GB-50A…
8.2
CVSS
1.8%
EPSS
No
On KEV
Description
Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.3.35 and prior, GB-50A Ver.3.35 and prior, GB-24A Ver.9.11 and prior, AG-150A-A Ver.3.20 and prior, AG-150A-J Ver.3.20 and prior, GB-50ADA-A Ver.3.20 and prior, GB-50ADA-J Ver.3.20 and prior, EB-50GU-A Ver 7.09 and prior, EB-50GU-J Ver 7.09 and prior, AE-200A Ver 7.93 and prior, AE-200E Ver 7.93 and prior, AE-50A Ver 7.93 and prior, AE-50E Ver 7.93 and prior, EW-50A Ver 7.93 and prior, EW-50E Ver 7.93 and prior, TE-200A Ver 7.93 and prior, TE-50A Ver 7.93 and prior, TW-50A Ver 7.93 and prior, CMS-RMD-J Ver.1.30 and prior), Air Conditioning System/Expansion Controllers (PAC-YG50ECA Ver.2.20 and prior) and Air Conditioning System/BM adapter(BAC-HD150 Ver.2.21 and prior) allows a remote unauthenticated attacker to disclose some of data in the air conditioning system or cause a DoS condition by sending specially crafted packets.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Air Conditioning System/Centralized Controllers G-50A; GB-50A; GB-24A; AG-150A-A; AG-150A-J; GB-50ADA-A; GB-50ADA-J; EB-50GU-A; EB-50GU-J; AE-200A; AE-200E; AE-50A; AE-50E; EW-50A; EW-50E; TE-200A; TE-50A; TW-50A; CMS-RMD-J; Air Conditioning System/Expansion Controllers PAC-YG50ECA; Air Conditioning ·
Ver.3.35 and prior; Ver.9.11 and prior; Ver.3.20 and prior; Ver 7.09 and prior; Ver 7.93 and prior; Ver.1.30 and prior; +2 more · source: vendor
AF
Ae-200a Firmware · Mitsubishi
through 7.93 · source: NVD
AF
Ae-200e Firmware · Mitsubishi
through 7.93 · source: NVD
AF
Ae-50a Firmware · Mitsubishi
through 7.93 · source: NVD
AF
Ae-50e Firmware · Mitsubishi
through 7.93 · source: NVD
AF
Ag-150a-a Firmware · Mitsubishi
through 3.20 · source: NVD
AF
Ag-150a-j Firmware · Mitsubishi
through 3.20 · source: NVD
CF
Cms-rmd-j Firmware · Mitsubishi
through 1.30 · source: NVD
EF
Eb-50gu-a Firmware · Mitsubishi
through 7.09 · source: NVD
EF
Eb-50gu-j Firmware · Mitsubishi
through 7.09 · source: NVD
EF
Ew-50a Firmware · Mitsubishi
through 7.93 · source: NVD
EF
Ew-50e Firmware · Mitsubishi
through 7.93 · source: NVD
Affected product
AC
Air Conditioning System/Centralized Controllers G-50A; GB-50A; GB-24A; AG-150A-A; AG-150A-J; GB-50ADA-A; GB-50ADA-J; EB-50GU-A; EB-50GU-J; AE-200A; AE-200E; AE-50A; AE-50E; EW-50A; EW-50E; TE-200A; TE-50A; TW-50A; CMS-RMD-J; Air Conditioning System/Expansion Controllers PAC-YG50ECA; Air Conditioning