NetSight
IP …
medium6.1

CVE-2022-33322

Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote …

Impact

Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch and Air Purifier) allows a remote unauthenticated attacker to execute an malicious script on a user's browser to disclose information, etc. The wide range of models/versions of Mitsubishi Electric consumer electronics products are affected by this vulnerability. As for the affected product models/versions, see the Mitsubishi Electric's advisory which is listed in [References] section.

Affected products

VendorProductAffected versions
MitsubishielectricMac-587if-E Firmware
through 35.00
MitsubishielectricMac-587if2-E Firmware
through 35.00
MitsubishielectricMac-507if-E Firmware
through 35.00
MitsubishielectricMac-588if-E Firmware
through 35.00
MitsubishielectricS-Mac-002if Firmware
through 35.00
MitsubishielectricMa-Ew85s-E Firmware
through 80.00
MitsubishielectricMa-Ew85s-Uk Firmware
through 80.00
MitsubishielectricMfz-Gxt50\/60\/73vfk Firmware
through 35.00
MitsubishielectricMfz-Xt50\/60vfk Firmware
through 35.00
MitsubishielectricMsxy-Fp05\/07\/10\/13\/18\/20\/24vgk-Sg1 Firmware
through 35.00
MitsubishielectricMsy-Gp10\/13\/15\/18\/20\/24vfk-Sg1 Firmware
through 35.00
MitsubishielectricMsz-Ap15\/20\/25\/35\/42\/50\/60\/71vgk-E2 Firmware
through 35.00

Weakness classification

CWE-79

References