PT-2021-14065 · Mitsubishi · Mitsubishi Electric Air Conditioning System/Centralized Controllers+1

Published 2021-07-13 · Updated 2021-08-05 · CVE-2021-20593

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 2.50 through 3.35 Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 3.20 and prior Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 7.09 and prior Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 7.93 and prior Mitsubishi Electric Air Conditioning System/Expansion Controllers versions 2.20 and prior CMS-RMD-J versions 1.30 and prior

Description: The issue is related to an incorrect implementation of the authentication algorithm, allowing a remote authenticated attacker to impersonate administrators. This can lead to the disclosure of configuration information of the air conditioning system and tampering with information, such as operation information and configuration of the air conditioning system.

Recommendations: For Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 2.50 through 3.35, update to a version outside of this range to resolve the issue. For Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 3.20 and prior, update to a version later than 3.20 to resolve the issue. For Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 7.09 and prior, update to a version later than 7.09 to resolve the issue. For Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 7.93 and prior, update to a version later than 7.93 to resolve the issue. For Mitsubishi Electric Air Conditioning System/Expansion Controllers versions 2.20 and prior, update to a version later than 2.20 to resolve the issue. For CMS-RMD-J versions 1.30 and prior, update to a version later than 1.30 to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-20593

Affected Products

Mitsubishi Electric Air Conditioning System/Centralized Controllers

Mitsubishi Electric Air Conditioning System/Expansion Controllers

References · 6

• https://osv.dev/vulnerability/CVE-2021-20593 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20593 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-004_en.pdf · Vendor Advisory
• https://jvn.jp/vu/JVNVU96046575/index.html · Note
• https://t.me/cvenotify/17527 · Telegram Post
• https://t.me/cvenotify/18700 · Telegram Post