Log in Start free

Vulnerability · Published Jun 17, 2026 · Assigned by Mitsubishi

CVE-2026-5667Information Disclosure, Information Tampering, or Denial-of-Service (DoS) Vulnerability in Multiple Home Appliances

High 7.2

In plain English

A high-severity hard-coded credentials in Room Air Conditioners (for Japan) MSZ-BKR2223-W from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).

Severity (CVSS 4.0)7.2High
Exploit odds (30 days)0.2%top 95.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for Japan and outside Japan); Wireless LAN Adapters for Room Air Conditioners (for Japan and outside Japan); Wireless LAN Adapters for Packaged Air Conditioners (for Japan and outside Japan); Refrigerators (for Japan); Heat Pump Water Heaters / HEMS-Compatible Adapters / Wireless LAN Adapters (for Japan); Bathroom Dryer / Heater / Ventilation Systems (for Japan); Adapters for Airflow Ventilation Systems, Heat Pump Chilled / Hot Water Systems, and Ventilation / Air-Conditioning System Air Resorts (for Japan); Lossnay Central Ventilation Systems (for Japan); Smart Switches for Ventilation Fans and Lossnay (for Japan); IH Cooking Heaters (for Japan); and Rice Cookers (for Japan) allows an attacker within Wi-Fi radio range of an affected product to access the affected product using a hard-coded SSID and password, thereby obtaining device data such as operation status, room set temperature, and room temperature; changing the air-conditioner or Wi-Fi settings; or causing Wi-Fi communication to enter a denial-of-service (DoS) condition.

Affected products (as reported)

VendorProductVersions
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR2223-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR2224-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR2523-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR2524-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR2823-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR2824-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR3623-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR3624-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR4023S-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR4024S-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR5623S-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR5624S-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR6323S-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR6324S-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR7123S-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR7124S-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BXV2223-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BXV2224-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BXV2225-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BXV2226-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BXV2523-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BXV2524-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BXV2525-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BXV2526-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BXV2823-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BXV2824-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BXV2825-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BXV2826-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BXV3623-W 42.00 and prior
Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BXV3624-W 42.00 and prior

Weakness: CWE-798 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

References