PT-2022-21769 · Mitsubishi · Mitsubishi Electric Consumer Electronics Products

Published 2022-11-08 · Updated 2025-05-01 · CVE-2022-33321

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric consumer electronics products (affected versions not specified)

Description A Cleartext Transmission of Sensitive Information issue exists due to the use of Basic Authentication for HTTP connections, allowing a remote unauthenticated attacker to disclose information or cause a denial of service (DoS) condition by sniffing credential information, such as username and password. This issue affects a wide range of Mitsubishi Electric consumer electronics products, including PHOTOVOLTAIC COLOR MONITOR ECO-GUIDE, HEMS adapter, Wi-Fi Interface, Air Conditioning, Induction hob, Mitsubishi Electric HEMS Energy Measurement Unit, Refrigerator, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch, Ventilating Fan, Range hood fan, Energy Measurement Unit, and Air Purifier.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2022-33321

Affected Products

Mitsubishi Electric Consumer Electronics Products

References · 8

• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-010_en.pdf · Vendor Advisory
• https://mitsubishielectric.co.jp/psirt/vulnerability/pdf/2022-010.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33321 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33321 · Vendor Advisory
• https://t.me/cvenotify/120557 · Telegram Post
• https://t.me/cvenotify/41620 · Telegram Post
• https://t.me/cibsecurity/52670 · Telegram Post
• https://jvn.jp/vu/JVNVU96767562/index.html · Note