CVE-2022-33322
Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric…
Does this matter?
Lower severity and a low EPSS score (0.90%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch and Air Purifier) allows a remote unauthenticated attacker to execute an malicious script on a user's browser to disclose information, etc. The wide range of models/versions of Mitsubishi Electric consumer electronics products are affected by this vulnerability. As for the affected product models/versions, see the Mitsubishi Electric's advisory which is listed in [References] section.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.90% probability · 58th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- mitsubishielectric/mac-587if-e firmware · mitsubishielectric/mac-587if2-e firmware · mitsubishielectric/mac-507if-e firmware · mitsubishielectric/mac-588if-e firmware · mitsubishielectric/s-mac-002if firmware · mitsubishielectric/ma-ew85s-e firmware · mitsubishielectric/ma-ew85s-uk firmware · mitsubishielectric/mfz-gxt50\/60\/73vfk firmware · mitsubishielectric/mfz-xt50\/60vfk firmware · mitsubishielectric/msxy-fp05\/07\/10\/13\/18\/20\/24vgk-sg1 firmware · mitsubishielectric/msy-gp10\/13\/15\/18\/20\/24vfk-sg1 firmware · mitsubishielectric/msz-ap15\/20\/25\/35\/42\/50\/60\/71vgk-e2 firmware · mitsubishielectric/msz-ap15\/20\/25\/35\/42\/50\/60\/71vgk-er2 firmware · mitsubishielectric/msz-ap15\/20\/25\/35\/42\/50\/60\/71vgk-et2 firmware · mitsubishielectric/msz-ap22\/25\/35\/42\/50\/60\/71\/80vgkd-a2 firmware · mitsubishielectric/msz-ap22\/25\/35\/42\/50\/61\/70\/80vgkd-a1 firmware · mitsubishielectric/msz-ap25\/35\/42\/50\/60\/71vgk-e3 firmware · mitsubishielectric/msz-ap25\/35\/42\/50\/60\/71vgk-er3 firmware · mitsubishielectric/msz-ap25\/35\/42\/50\/60\/71vgk-et3 firmware · mitsubishielectric/msz-ap25\/35\/42\/50vgk-e1 firmware · +40 more
- Source
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
References
- https://jvn.jp/vu/JVNVU96767562/index.htmlThird Party Advisory, VDB Entry
- https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2022-011.pdfMitigation, Vendor Advisory
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-011_en.pdfMitigation, Vendor Advisory
- https://jvn.jp/vu/JVNVU96767562/index.htmlThird Party Advisory, VDB Entry
- https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2022-011.pdfMitigation, Vendor Advisory
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-011_en.pdfMitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.