CVE-2021-20595
Summary
| CVE | CVE-2021-20595 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-07-13 11:15:00 UTC |
| Updated | 2021-08-04 19:07:00 UTC |
| Description | Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.3.35 and prior, GB-50A Ver.3.35 and prior, GB-24A Ver.9.11 and prior, AG-150A-A Ver.3.20 and prior, AG-150A-J Ver.3.20 and prior, GB-50ADA-A Ver.3.20 and prior, GB-50ADA-J Ver.3.20 and prior, EB-50GU-A Ver 7.09 and prior, EB-50GU-J Ver 7.09 and prior, AE-200A Ver 7.93 and prior, AE-200E Ver 7.93 and prior, AE-50A Ver 7.93 and prior, AE-50E Ver 7.93 and prior, EW-50A Ver 7.93 and prior, EW-50E Ver 7.93 and prior, TE-200A Ver 7.93 and prior, TE-50A Ver 7.93 and prior, TW-50A Ver 7.93 and prior, CMS-RMD-J Ver.1.30 and prior), Air Conditioning System/Expansion Controllers (PAC-YG50ECA Ver.2.20 and prior) and Air Conditioning System/BM adapter(BAC-HD150 Ver.2.21 and prior) allows a remote unauthenticated attacker to disclose some of data in the air conditioning system or cause a DoS condition by sending specially crafted packets. |
Risk And Classification
Problem Types: CWE-611
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Mitsubishi | Ae-200a | - | All | All | All |
| Operating System | Mitsubishi | Ae-200a Firmware | All | All | All | All |
| Hardware | Mitsubishi | Ae-200e | - | All | All | All |
| Operating System | Mitsubishi | Ae-200e Firmware | All | All | All | All |
| Hardware | Mitsubishi | Ae-50a | - | All | All | All |
| Operating System | Mitsubishi | Ae-50a Firmware | All | All | All | All |
| Hardware | Mitsubishi | Ae-50e | - | All | All | All |
| Operating System | Mitsubishi | Ae-50e Firmware | All | All | All | All |
| Hardware | Mitsubishi | Ag-150a-a | - | All | All | All |
| Operating System | Mitsubishi | Ag-150a-a Firmware | All | All | All | All |
| Hardware | Mitsubishi | Ag-150a-j | - | All | All | All |
| Operating System | Mitsubishi | Ag-150a-j Firmware | All | All | All | All |
| Hardware | Mitsubishi | Cms-rmd-j | - | All | All | All |
| Operating System | Mitsubishi | Cms-rmd-j Firmware | All | All | All | All |
| Hardware | Mitsubishi | Eb-50gu-a | - | All | All | All |
| Operating System | Mitsubishi | Eb-50gu-a Firmware | All | All | All | All |
| Hardware | Mitsubishi | Eb-50gu-j | - | All | All | All |
| Operating System | Mitsubishi | Eb-50gu-j Firmware | All | All | All | All |
| Hardware | Mitsubishi | Ew-50a | - | All | All | All |
| Operating System | Mitsubishi | Ew-50a Firmware | All | All | All | All |
| Hardware | Mitsubishi | Ew-50e | - | All | All | All |
| Operating System | Mitsubishi | Ew-50e Firmware | All | All | All | All |
| Hardware | Mitsubishi | G-50a | - | All | All | All |
| Operating System | Mitsubishi | G-50a Firmware | All | All | All | All |
| Hardware | Mitsubishi | Gb-50a | - | All | All | All |
| Hardware | Mitsubishi | Gb-50ada-a | - | All | All | All |
| Operating System | Mitsubishi | Gb-50ada-a Firmware | All | All | All | All |
| Hardware | Mitsubishi | Gb-50ada-j | - | All | All | All |
| Operating System | Mitsubishi | Gb-50ada-j Firmware | All | All | All | All |
| Operating System | Mitsubishi | Gb-50a Firmware | All | All | All | All |
| Hardware | Mitsubishi | Pac-yg50eca | - | All | All | All |
| Operating System | Mitsubishi | Pac-yg50eca Firmware | All | All | All | All |
| Hardware | Mitsubishi | Te-200a | - | All | All | All |
| Operating System | Mitsubishi | Te-200a Firmware | All | All | All | All |
| Hardware | Mitsubishi | Te-50a | - | All | All | All |
| Operating System | Mitsubishi | Te-50a Firmware | All | All | All | All |
| Hardware | Mitsubishi | Tw-50a | - | All | All | All |
| Operating System | Mitsubishi | Tw-50a Firmware | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| JVNVU#93086468: 三菱電機製空調管理システムにおける XML 外部実体参照 (XXE) の不適切な制限に関する脆弱性 | MISC | jvn.jp | |
| www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-005_en.pdf | MISC | www.mitsubishielectric.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 590709 Mitsubishi Electric Air Conditioning Systems Vulnerability (ICSA-21-182-05)