Vulnerability Details : CVE-2021-20595
Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.3.35 and prior, GB-50A Ver.3.35 and prior, GB-24A Ver.9.11 and prior, AG-150A-A Ver.3.20 and prior, AG-150A-J Ver.3.20 and prior, GB-50ADA-A Ver.3.20 and prior, GB-50ADA-J Ver.3.20 and prior, EB-50GU-A Ver 7.09 and prior, EB-50GU-J Ver 7.09 and prior, AE-200A Ver 7.93 and prior, AE-200E Ver 7.93 and prior, AE-50A Ver 7.93 and prior, AE-50E Ver 7.93 and prior, EW-50A Ver 7.93 and prior, EW-50E Ver 7.93 and prior, TE-200A Ver 7.93 and prior, TE-50A Ver 7.93 and prior, TW-50A Ver 7.93 and prior, CMS-RMD-J Ver.1.30 and prior), Air Conditioning System/Expansion Controllers (PAC-YG50ECA Ver.2.20 and prior) and Air Conditioning System/BM adapter(BAC-HD150 Ver.2.21 and prior) allows a remote unauthenticated attacker to disclose some of data in the air conditioning system or cause a DoS condition by sending specially crafted packets.
Vulnerability category: XML external entity (XXE) injectionDenial of service
Products affected by CVE-2021-20595
- cpe:2.3:o:mitsubishi:g-50a_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:gb-50a_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:ag-150a-a_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:ag-150a-j_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:gb-50ada-a_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:gb-50ada-j_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:eb-50gu-a_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:eb-50gu-j_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:ae-200a_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:ae-200e_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:ae-50a_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:ae-50e_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:ew-50a_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:ew-50e_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:te-200a_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:te-50a_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:tw-50a_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:cms-rmd-j_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:mitsubishi:pac-yg50eca_firmware:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-20595
0.15%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 33 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-20595
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:N/A:C |
10.0
|
7.8
|
NIST | |
|
8.2
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
3.9
|
4.2
|
NIST |
CWE ids for CVE-2021-20595
-
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-20595
-
https://jvn.jp/vu/JVNVU93086468/index.html
JVNVU#93086468: 三菱電機製空調管理システムにおける XML 外部実体参照 (XXE) の不適切な制限に関する脆弱性Third Party Advisory
-
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-005_en.pdf
Vendor Advisory
Jump to