Mitsubishi Electric AC Systems Vulnerability Allows Remote Control Without User Interaction
- С сайта: Vulnerability(cybersecuritynews.com)
- Вернуться к списку новостей
С сайта: Vulnerability(cybersecuritynews.com)
Mitsubishi Electric has disclosed a critical authentication bypass vulnerability affecting 27 different air conditioning system models, potentially allowing remote attackers to gain unauthorized control over building HVAC systems.
The vulnerability, tracked as CVE-2025-3699, carries a maximum CVSS score of 9.8, indicating its severe nature.
The vulnerability stems from a “Missing Authentication for Critical Function” weakness that enables attackers to bypass authentication mechanisms entirely.
Once exploited, malicious actors can illegally control air conditioning systems, access sensitive information, and even tamper with firmware using disclosed data.
The attack requires no user interaction and can be executed remotely over network connections, making it particularly dangerous.
Security researcher Mihály Csonka discovered and reported the vulnerability to Mitsubishi Electric, highlighting the collaborative effort between the security community and manufacturers to identify and address critical infrastructure vulnerabilities.
Widespread Impact Across Product Lines
The vulnerability affects a comprehensive range of Mitsubishi Electric air conditioning systems, including the G-50 series, GB-50 series, AE-200 and AE-50 series, EW-50 series, and various other models.
All affected systems running firmware versions 3.37 and prior (for G-series models), 9.12 and prior (for GB-24A), 3.21 and prior (for G-150AD and related models), 7.11 and prior (for EB-50GU models), 8.01 and prior (for AE/EW/TE/TW series), and 1.40 and prior (for CMS-RMD-J) are vulnerable to this attack vector.
The broad scope of affected products underscores the potential impact on commercial buildings, industrial facilities, and other environments where these systems are deployed for climate control and building automation.
Mitsubishi Electric outlined three system configuration scenarios in their advisory. The vulnerability poses the greatest risk in improperly configured environments where air conditioning systems are directly accessible from the internet without VPN protection.
In contrast, systems properly isolated within internal networks or protected by VPN routers face significantly reduced risk, as external attackers cannot directly reach the vulnerable services.
The company emphasized that their air conditioning systems are designed for use within secure intranet environments or networks protected by VPN infrastructure, highlighting the importance of proper network segmentation and access controls.
No Patches Available
Notably, Mitsubishi Electric announced there are no plans to release fixed firmware versions for most affected products. However, the company is preparing improved versions for select models in the AE-200, AE-50, EW-50, TE-200, TE-50, and TW-50A series to address this vulnerability.
Complete Affected Systems Table
SeriesModelAffected VersionCVECVSS Score AE Series AE-200AVer.8.01 and prior1CVE-2025-36999.8 AE Series AE-200EVer.8.01 and prior1CVE-2025-36999.8 AE Series AE-200JVer.8.01 and prior1CVE-2025-36999.8 AE Series AE-50AVer.8.01 and prior1CVE-2025-36999.8 AE Series AE-50EVer.8.01 and prior1CVE-2025-36999.8 AE Series AE-50JVer.8.01 and prior1CVE-2025-36999.8 CMS Series CMS-RMD-JVer.1.40 and prior1CVE-2025-36999.8 EB-50GU Series EB-50GU-AVer.7.11 and prior1CVE-2025-36999.8 EB-50GU Series EB-50GU-JVer.7.11 and prior1CVE-2025-36999.8 EW-50 Series EW-50AVer.8.01 and prior1CVE-2025-36999.8 EW-50 Series EW-50EVer.8.01 and prior1CVE-2025-36999.8 EW-50 Series EW-50JVer.8.01 and prior1CVE-2025-36999.8 G-150/AG-150/GB-50AD Series AG-150A-AVer.3.21 and prior1CVE-2025-36999.8 G-150/AG-150/GB-50AD Series AG-150A-JVer.3.21 and prior1CVE-2025-36999.8 G-150/AG-150/GB-50AD Series G-150ADVer.3.21 and prior1CVE-2025-36999.8 G-150/AG-150/GB-50AD Series GB-50ADVer.3.21 and prior1CVE-2025-36999.8 G-150/AG-150/GB-50AD Series GB-50ADA-AVer.3.21 and prior1CVE-2025-36999.8 G-150/AG-150/GB-50AD Series GB-50ADA-JVer.3.21 and prior1CVE-2025-36999.8 G-50/GB-50 Series G-50Ver.3.37 and prior1CVE-2025-36999.8 G-50/GB-50 Series G-50-WVer.3.37 and prior1CVE-2025-36999.8 G-50/GB-50 Series G-50AVer.3.37 and prior1CVE-2025-36999.8 G-50/GB-50 Series GB-50Ver.3.37 and prior1CVE-2025-36999.8 G-50/GB-50 Series GB-50AVer.3.37 and prior1CVE-2025-36999.8 GB-24A Series GB-24AVer.9.12 and prior1CVE-2025-36999.8 TE Series TE-200AVer.8.01 and prior1CVE-2025-36999.8 TE Series TE-50AVer.8.01 and prior1CVE-2025-36999.8 TW Series TW-50AVer.8.01 and prior1CVE-2025-36999.8
For immediate protection, Mitsubishi Electric recommends implementing several mitigation strategies: restricting network access from untrusted sources, limiting physical access to systems and connected infrastructure, and maintaining updated antivirus software and web browsers on computers used to manage these systems.
This disclosure highlights the growing security challenges facing building automation and IoT infrastructure. As critical systems become increasingly connected, the potential for remote exploitation grows, emphasizing the need for robust security practices in industrial and commercial environments.
Organizations using affected Mitsubishi Electric air conditioning systems should immediately assess their network configurations and implement recommended security measures to prevent potential exploitation of this critical vulnerability.
#Cyber_Security #Cyber_Security_News #Vulnerability #cyber_security #cyber_security_news #vulnerability
Оригинальная версия на сайте:
Mitsubishi Electric AC Systems Vulnerability Allows Remote Control Without User Interaction
Author: Guru BaranMitsubishi Electric has disclosed a critical authentication bypass vulnerability affecting 27 different air conditioning system models, potentially allowing remote attackers to gain unauthorized control over building HVAC systems.
The vulnerability, tracked as CVE-2025-3699, carries a maximum CVSS score of 9.8, indicating its severe nature.
The vulnerability stems from a “Missing Authentication for Critical Function” weakness that enables attackers to bypass authentication mechanisms entirely.
Once exploited, malicious actors can illegally control air conditioning systems, access sensitive information, and even tamper with firmware using disclosed data.
The attack requires no user interaction and can be executed remotely over network connections, making it particularly dangerous.
Security researcher Mihály Csonka discovered and reported the vulnerability to Mitsubishi Electric, highlighting the collaborative effort between the security community and manufacturers to identify and address critical infrastructure vulnerabilities.
Widespread Impact Across Product Lines
The vulnerability affects a comprehensive range of Mitsubishi Electric air conditioning systems, including the G-50 series, GB-50 series, AE-200 and AE-50 series, EW-50 series, and various other models.
All affected systems running firmware versions 3.37 and prior (for G-series models), 9.12 and prior (for GB-24A), 3.21 and prior (for G-150AD and related models), 7.11 and prior (for EB-50GU models), 8.01 and prior (for AE/EW/TE/TW series), and 1.40 and prior (for CMS-RMD-J) are vulnerable to this attack vector.
The broad scope of affected products underscores the potential impact on commercial buildings, industrial facilities, and other environments where these systems are deployed for climate control and building automation.
Mitsubishi Electric outlined three system configuration scenarios in their advisory. The vulnerability poses the greatest risk in improperly configured environments where air conditioning systems are directly accessible from the internet without VPN protection.
In contrast, systems properly isolated within internal networks or protected by VPN routers face significantly reduced risk, as external attackers cannot directly reach the vulnerable services.
The company emphasized that their air conditioning systems are designed for use within secure intranet environments or networks protected by VPN infrastructure, highlighting the importance of proper network segmentation and access controls.
No Patches Available
Notably, Mitsubishi Electric announced there are no plans to release fixed firmware versions for most affected products. However, the company is preparing improved versions for select models in the AE-200, AE-50, EW-50, TE-200, TE-50, and TW-50A series to address this vulnerability.
Complete Affected Systems Table
SeriesModelAffected VersionCVECVSS Score AE Series AE-200AVer.8.01 and prior1CVE-2025-36999.8 AE Series AE-200EVer.8.01 and prior1CVE-2025-36999.8 AE Series AE-200JVer.8.01 and prior1CVE-2025-36999.8 AE Series AE-50AVer.8.01 and prior1CVE-2025-36999.8 AE Series AE-50EVer.8.01 and prior1CVE-2025-36999.8 AE Series AE-50JVer.8.01 and prior1CVE-2025-36999.8 CMS Series CMS-RMD-JVer.1.40 and prior1CVE-2025-36999.8 EB-50GU Series EB-50GU-AVer.7.11 and prior1CVE-2025-36999.8 EB-50GU Series EB-50GU-JVer.7.11 and prior1CVE-2025-36999.8 EW-50 Series EW-50AVer.8.01 and prior1CVE-2025-36999.8 EW-50 Series EW-50EVer.8.01 and prior1CVE-2025-36999.8 EW-50 Series EW-50JVer.8.01 and prior1CVE-2025-36999.8 G-150/AG-150/GB-50AD Series AG-150A-AVer.3.21 and prior1CVE-2025-36999.8 G-150/AG-150/GB-50AD Series AG-150A-JVer.3.21 and prior1CVE-2025-36999.8 G-150/AG-150/GB-50AD Series G-150ADVer.3.21 and prior1CVE-2025-36999.8 G-150/AG-150/GB-50AD Series GB-50ADVer.3.21 and prior1CVE-2025-36999.8 G-150/AG-150/GB-50AD Series GB-50ADA-AVer.3.21 and prior1CVE-2025-36999.8 G-150/AG-150/GB-50AD Series GB-50ADA-JVer.3.21 and prior1CVE-2025-36999.8 G-50/GB-50 Series G-50Ver.3.37 and prior1CVE-2025-36999.8 G-50/GB-50 Series G-50-WVer.3.37 and prior1CVE-2025-36999.8 G-50/GB-50 Series G-50AVer.3.37 and prior1CVE-2025-36999.8 G-50/GB-50 Series GB-50Ver.3.37 and prior1CVE-2025-36999.8 G-50/GB-50 Series GB-50AVer.3.37 and prior1CVE-2025-36999.8 GB-24A Series GB-24AVer.9.12 and prior1CVE-2025-36999.8 TE Series TE-200AVer.8.01 and prior1CVE-2025-36999.8 TE Series TE-50AVer.8.01 and prior1CVE-2025-36999.8 TW Series TW-50AVer.8.01 and prior1CVE-2025-36999.8
For immediate protection, Mitsubishi Electric recommends implementing several mitigation strategies: restricting network access from untrusted sources, limiting physical access to systems and connected infrastructure, and maintaining updated antivirus software and web browsers on computers used to manage these systems.
This disclosure highlights the growing security challenges facing building automation and IoT infrastructure. As critical systems become increasingly connected, the potential for remote exploitation grows, emphasizing the need for robust security practices in industrial and commercial environments.
Organizations using affected Mitsubishi Electric air conditioning systems should immediately assess their network configurations and implement recommended security measures to prevent potential exploitation of this critical vulnerability.
#Cyber_Security #Cyber_Security_News #Vulnerability #cyber_security #cyber_security_news #vulnerability
Оригинальная версия на сайте:
