Search/CVE-2021-20595
● CVE — High

CVE-2021-20595

VendormitsubishiProductae-200a firmware, ae-200e firmware, ae-50a firmware, ae-50e firmware, ag-150a-a firmware, ag-150a-j firmware, cms-rmd-j firmware, eb-50gu-a firmware, eb-50gu-j firmware, ew-50a firmware, ew-50e firmware, g-50a firmware, gb-50a firmware, gb-50ada-a firmware, gb-50ada-j firmware, pac-yg50eca firmware, te-200a firmware, te-50a firmware, tw-50a firmwareDiscoveredJul 13, 2021UpdatedNov 21, 2024

Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.3.35 and prior, GB-50A Ver.3.35 and prior, GB-24A Ver.9.11 and prior, AG-150A-A Ver.3.20 and prior, AG-150A-J Ver.3.20 and prior, GB-50ADA-A Ver.3.20 and prior, GB-50ADA-J Ver.3.20 and prior, EB-50GU-A Ver 7.09 and prior, EB-50GU-J Ver 7.09 and prior, AE-200A Ver 7.93 and prior, AE-200E Ver 7.93 and prior, AE-50A Ver 7.93 and prior, AE-50E Ver 7.93 and prior, EW-50A Ver 7.93 and prior, EW-50E Ver 7.93 and prior, TE-200A Ver 7.93 and prior, TE-50A Ver 7.93 and prior, TW-50A Ver 7.93 and prior, CMS-RMD-J Ver.1.30 and prior), Air Conditioning System/Expansion Controllers (PAC-YG50ECA Ver.2.20 and prior) and Air Conditioning System/BM…

CVSS v3.1
8.2 HIGH
EPSS
1.78%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityLOW
IntegrityNONE
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Connections
20 relationships
Timeline
disclosure → media coverage
Jul 13, 2021
Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024