Vulnerability in Mitsubishielectric Mac-507if-E
CVE-2022-33321
Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer electronics products (PHOTOVOLTAIC COLOR MONITOR ECO-GUIDE, HEMS adapter, Wi-Fi Interface, Air Conditioning, Induction hob, Mitsubishi Electric HEMS Energy Measurement Unit, Refrigerator, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch, Ventilating Fan, Range hood fan, Energy Measurement Unit and Air Purifier) allows a remote unauthenticated attacker to disclose information in the products or cause a denial of service (DoS) condition as a result by sniffing credential information (username and password). The wide range of models/versions of Mitsubishi Electric consumer electronics products are affected by this vulnerability. As for the affected product models/versions, see the Mitsubishi Electric's advisory which is listed in [References] section.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.010 (60.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 60.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.010 · change: +0.000
Affected products
- Mitsubishielectric Mac-507if-E
- Mitsubishielectric Mac-507if-E Firmware
- Mitsubishielectric Mac-557if-E
- Mitsubishielectric Mac-557if-E1
- Mitsubishielectric Mac-557if-E1 Firmware
- Mitsubishielectric Mac-557if-E Firmware
- Mitsubishielectric Mac-558if-E
- Mitsubishielectric Mac-558if-E1
- Mitsubishielectric Mac-558if-E1 Firmware
- Mitsubishielectric Mac-558if-E Firmware
Weakness classification (CWE)
References
- jvn.jp/vu/JVNVU96767562/index.html (Third Party Advisory, government-resource)
- www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-010_en.pdf (vendor-advisory, Vendor Advisory)
- www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2022-010.pdf (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-33321?
- CVE-2022-33321 is a critical-severity vulnerability in Mitsubishielectric Mac-507if-E, classified under Cleartext Transmission of Sensitive Information. CVSS score: 9.8/10. Published 2022-11-08.
- How severe is CVE-2022-33321?
- Critical severity. CVSS v3 base score is 9.8 out of 10.