Log in Start free

Vulnerability · Published Nov 8, 2022 · Assigned by Mitsubishi

CVE-2022-33322

Medium 6.1

In plain English

A medium-severity cross-site scripting in Air Conditioning MSXY-FP05/07/10/13/18/20/24VGK-SG1 from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)1.1%top 33.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch and Air Purifier) allows a remote unauthenticated attacker to execute an malicious script on a user's browser to disclose information, etc. The wide range of models/versions of Mitsubishi Electric consumer electronics products are affected by this vulnerability. As for the affected product models/versions, see the Mitsubishi Electric's advisory which is listed in [References] section.

Affected products (as reported)

VendorProductVersions
Mitsubishi Electric Corporation Air Conditioning MSZ-FD40/56/63/71/8022S versions 30.00 to 35.00
Mitsubishi Electric Corporation Air Conditioning MSZ-HXV25/28/40/56/63/71/8022S versions 30.00 to 35.00
Mitsubishi Electric Corporation Air Conditioning MSZ-VXV40/56/63/71/8022S versions 30.00 to 35.00
Mitsubishi Electric Corporation Air Conditioning MSZ-ZD25/28/40/56/63/71/8022(S) versions 30.00 to 35.00
Mitsubishi Electric Corporation Air Conditioning MSZ-FZ40/56/63/71/80/9021S versions 30.00 to 35.00
Mitsubishi Electric Corporation Air Conditioning MSZ-ZW22/25/28/36/40/56/63/71/80/9021(S) versions 30.00 to 35.00
Mitsubishi Electric Corporation Air Conditioning MSZ-FZV40/56/63/71/80/9021S versions 30.00 to 35.00
Mitsubishi Electric Corporation Air Conditioning MSZ-ZXV22/25/28/36/40/56/63/71/80/9021(S) versions 30.00 to 35.00
Mitsubishi Electric Corporation Air Conditioning MSZ-EM22/25/28/36/40/56/63/71/80/9021E9(S) versions 30.00 to 35.00
Mitsubishi Electric Corporation Air Conditioning MSZ-FZ40/56/63/71/80/9020S versions 30.00 to 35.00
Mitsubishi Electric Corporation Air Conditioning MSZ-ZW22/25/28/36/40/56/63/71/80/9020(S) versions 30.00 to 35.00
Mitsubishi Electric Corporation Air Conditioning MSZ-FZV40/56/63/71/80/9020S versions 30.00 to 35.00
Mitsubishi Electric Corporation Air Conditioning MSZ-ZXV22/25/28/36/40/56/63/71/80/9020(S) versions 30.00 to 35.00
Mitsubishi Electric Corporation Air Conditioning MSZ-EM22/25/28/36/40/56/63/71/80/9020E8(S) versions 30.00 to 35.00
Mitsubishi Electric Corporation Wi-Fi Interface MAC-900IF versions 30.00 to 35.00
Mitsubishi Electric Corporation Wi-Fi Interface PAC-SK43ML versions 30.00 to 35.00
Mitsubishi Electric Corporation Refrigerator MR-MXD50/57G versions 00.68 and prior
Mitsubishi Electric Corporation Refrigerator MR-WXD52/60/70G versions 00.68 and prior
Mitsubishi Electric Corporation Refrigerator MR-WZ55/61H versions 00.68 and prior
Mitsubishi Electric Corporation Refrigerator MR-MZ54/60H versions 00.68 and prior
Mitsubishi Electric Corporation HEMS adapter GT-HEM4 versions 00.83 and prior
Mitsubishi Electric Corporation Wi-Fi Interface GT-RA1 versions 00.83 and prior
Mitsubishi Electric Corporation Wi-Fi Interface GT-RA2 versions 00.83 and prior
Mitsubishi Electric Corporation Wi-Fi Interface GT-HR1 versions 00.83 and prior
Mitsubishi Electric Corporation Remote control with Wi-Fi Interface RMCB-H6SE-T versions 00.83 and prior
Mitsubishi Electric Corporation Remote control with Wi-Fi Interface RMCB-F6SE-T versions 00.83 and prior
Mitsubishi Electric Corporation Remote control with Wi-Fi Interface RMCB-D6SE-T versions 00.83 and prior
Mitsubishi Electric Corporation BATHROOM THERMO VENTILATOR V-241BZ-RC versions 00.65 and prior
Mitsubishi Electric Corporation BATHROOM THERMO VENTILATOR V-241BZ5-RC versions 00.65 and prior
Mitsubishi Electric Corporation BATHROOM THERMO VENTILATOR WD-240DK-RC versions 00.65 and prior

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References