PT-2021-14066 · Mitsubishi · Mitsubishi Electric Air Conditioning System/Bm Adapter+2

Published 2021-07-07 · Updated 2021-08-04 · CVE-2021-20595

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 3.35 and prior Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 3.20 and prior Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 9.11 and prior Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 7.09 and prior Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 7.93 and prior Mitsubishi Electric Air Conditioning System/Expansion Controllers versions 2.20 and prior Mitsubishi Electric Air Conditioning System/BM adapter versions 2.21 and prior Mitsubishi Electric Air Conditioning System/Expansion Controllers versions 1.30 and prior

Description: The issue is related to an Improper Restriction of XML External Entity Reference, allowing a remote unauthenticated attacker to disclose some data in the air conditioning system or cause a Denial of Service (DoS) condition by sending specially crafted packets.

Recommendations: For Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 3.35 and prior, update to a version later than 3.35. For Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 3.20 and prior, update to a version later than 3.20. For Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 9.11 and prior, update to a version later than 9.11. For Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 7.09 and prior, update to a version later than 7.09. For Mitsubishi Electric Air Conditioning System/Centralized Controllers versions 7.93 and prior, update to a version later than 7.93. For Mitsubishi Electric Air Conditioning System/Expansion Controllers versions 2.20 and prior, update to a version later than 2.20. For Mitsubishi Electric Air Conditioning System/BM adapter versions 2.21 and prior, update to a version later than 2.21. For Mitsubishi Electric Air Conditioning System/Expansion Controllers versions 1.30 and prior, update to a version later than 1.30.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-20595

Affected Products

Mitsubishi Electric Air Conditioning System/Bm Adapter

Mitsubishi Electric Air Conditioning System/Centralized Controllers

Mitsubishi Electric Air Conditioning System/Expansion Controllers

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-20595 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-005_en.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20595 · Vendor Advisory
• https://t.me/rnetsec/15248 · Telegram Post
• https://t.me/pentestingnews/6964 · Telegram Post
• https://jvn.jp/vu/JVNVU93086468/index.html · Note