7.1

CVE-2021-20593

Incorrect Implementation of Authentication Algorithm in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.2.50 to Ver. 3.35, GB-50A Ver.2.50 to Ver. 3.35, AG-150A-A Ver.3.20 and prior, AG-150A-J Ver.3.20 and prior, GB-50ADA-A Ver.3.20 and prior, GB-50ADA-J Ver.3.20 and prior, EB-50GU-A Ver 7.09 and prior, EB-50GU-J Ver 7.09 and prior, AE-200A Ver 7.93 and prior, AE-200E Ver 7.93 and prior, AE-50A Ver 7.93 and prior, AE-50E Ver 7.93 and prior, EW-50A Ver 7.93 and prior, EW-50E Ver 7.93 and prior, TE-200A Ver 7.93 and prior, TE-50A Ver 7.93 and prior, TW-50A Ver 7.93 and prior, CMS-RMD-J Ver.1.30 and prior) and Air Conditioning System/Expansion Controllers (PAC-YG50ECA Ver.2.20 and prior) allows a remote authenticated attacker to impersonate administrators to disclose configuration information of the air conditioning system and tamper information (e.g. operation information and configuration of air conditioning system) by exploiting this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mitsubishi ≫ G-50a Firmware Version >= 2.50 <= 3.35
   Mitsubishi ≫ G-50a Version-
Mitsubishi ≫ Gb-50a Firmware Version >= 2.50 <= 3.35
   Mitsubishi ≫ Gb-50a Version-
Mitsubishi ≫ Ag-150a-a Firmware Version <= 3.20
   Mitsubishi ≫ Ag-150a-a Version-
Mitsubishi ≫ Ag-150a-j Firmware Version <= 3.20
   Mitsubishi ≫ Ag-150a-j Version-
Mitsubishi ≫ Gb-50ada-a Firmware Version <= 3.20
   Mitsubishi ≫ Gb-50ada-a Version-
Mitsubishi ≫ Gb-50ada-j Firmware Version <= 3.20
   Mitsubishi ≫ Gb-50ada-j Version-
Mitsubishi ≫ Eb-50gu-a Firmware Version <= 7.09
   Mitsubishi ≫ Eb-50gu-a Version-
Mitsubishi ≫ Eb-50gu-j Firmware Version <= 7.09
   Mitsubishi ≫ Eb-50gu-j Version-
Mitsubishi ≫ Ae-200a Firmware Version <= 7.93
   Mitsubishi ≫ Ae-200a Version-
Mitsubishi ≫ Ae-200e Firmware Version <= 7.93
   Mitsubishi ≫ Ae-200e Version-
Mitsubishi ≫ Ae-50a Firmware Version <= 7.93
   Mitsubishi ≫ Ae-50a Version-
Mitsubishi ≫ Ae-50e Firmware Version <= 7.93
   Mitsubishi ≫ Ae-50e Version-
Mitsubishi ≫ Ew-50a Firmware Version <= 7.93
   Mitsubishi ≫ Ew-50a Version-
Mitsubishi ≫ Ew-50e Firmware Version <= 7.93
   Mitsubishi ≫ Ew-50e Version-
Mitsubishi ≫ Te-200a Firmware Version <= 7.93
   Mitsubishi ≫ Te-200a Version-
Mitsubishi ≫ Te-50a Firmware Version <= 7.93
   Mitsubishi ≫ Te-50a Version-
Mitsubishi ≫ Tw-50a Firmware Version <= 7.93
   Mitsubishi ≫ Tw-50a Version-
Mitsubishi ≫ Cms-rmd-j Firmware Version <= 1.30
   Mitsubishi ≫ Cms-rmd-j Version-
Mitsubishi ≫ Pac-yg50eca Firmware Version <= 2.20
   Mitsubishi ≫ Pac-yg50eca Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.496
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.1 2.8 4.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
nvd@nist.gov 5.5 8 4.9
AV:N/AC:L/Au:S/C:P/I:P/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.