XML external entity injection in Air Conditioning System/Centralized Controllers G-50A…
Priority LOW 39CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.3.35 and prior, GB-50A Ver.3.35 and prior, GB-24A Ver.9.11 and prior, AG-150A-A Ver.3.20 and prior, AG-150A-J Ver.3.20 and prior, GB-50ADA-A Ver.3.20 and prior, GB-50ADA-J Ver.3.20 and prior, EB-50GU-A Ver 7.09 and prior, EB-50GU-J Ver 7.09 and prior, AE-200A Ver 7.93 and prior, AE-200E Ver 7.93 and prior, AE-50A Ver 7.93 and prior, AE-50E Ver 7.93 and prior, EW-50A Ver 7.93 and prior, EW-50E Ver 7.93 and prior, TE-200A Ver 7.93 and prior, TE-50A Ver 7.93 and prior, TW-50A Ver 7.93 and prior, CMS-RMD-J Ver.1.30 and prior), Air Conditioning System/Expansion Controllers (PAC-YG50ECA Ver.2.20 and prior) and Air Conditioning System/BM adapter(BAC-HD150 Ver.2.21 and prior) allows a remote unauthenticated attacker to disclose some of data in the air conditioning system or cause a DoS condition by sending specially crafted packets.
Why it matters now
EPSS 0.01781 78th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Air Conditioning System/Centralized Controllers G-50A; GB-50A; GB-24A; AG-150A-A; AG-150A-J; GB-50ADA-A; GB-50ADA-J; EB-50GU-A; EB-50GU-J; AE-200A; AE-200E; AE-50A; AE-50E; EW-50A; EW-50E; TE-200A; TE-50A; TW-50A; CMS-RMD-J; Air Conditioning System/Expansion Controllers PAC-YG50ECA; Air Conditioning System/BM adapter BAC-HD150 | Ver.3.35 and prior; Ver.9.11 and prior; Ver.3.20 and prior; Ver 7.09 and prior; Ver 7.93 and prior; Ver.1.30 and prior; Ver.2.20 and prior; Ver.2.21 and prior | — | No fix listed | CNA |
- Air Conditioning System/Centralized Controllers G-50A; GB-50A; GB-24A; AG-150A-A; AG-150A-J; GB-50ADA-A; GB-50ADA-J; EB-50GU-A; EB-50GU-J; AE-200A; AE-200E; AE-50A; AE-50E; EW-50A; EW-50E; TE-200A; TE-50A; TW-50A; CMS-RMD-J; Air Conditioning System/Expansion Controllers PAC-YG50ECA; Air Conditioning System/BM adapter BAC-HD150 Vendor— Affected Ver.3.35 and prior; Ver.9.11 and prior; Ver.3.20 and prior; Ver 7.09 and prior; Ver 7.93 and prior; Ver.1.30 and prior; Ver.2.20 and prior; Ver.2.21 and prior Fixed in — No fix listed CNA
CPE configurations NVD · 38
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mitsubishi:g-50a_firmware:*:*:*:*:*:*:*:* | 2.50 – 3.35 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:g-50a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:gb-50a_firmware:*:*:*:*:*:*:*:* | 2.50 – 3.35 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:gb-50a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ag-150a-a_firmware:*:*:*:*:*:*:*:* | up to 3.20 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ag-150a-a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ag-150a-j_firmware:*:*:*:*:*:*:*:* | up to 3.20 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ag-150a-j:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:gb-50ada-a_firmware:*:*:*:*:*:*:*:* | up to 3.20 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:gb-50ada-a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
- cpe:2.3:o:mitsubishi:g-50a_firmware:*:*:*:*:*:*:*:* Versions 2.50 – 3.35 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:g-50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:gb-50a_firmware:*:*:*:*:*:*:*:* Versions 2.50 – 3.35 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:gb-50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ag-150a-a_firmware:*:*:*:*:*:*:*:* Versions up to 3.20 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ag-150a-a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ag-150a-j_firmware:*:*:*:*:*:*:*:* Versions up to 3.20 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ag-150a-j:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:gb-50ada-a_firmware:*:*:*:*:*:*:*:* Versions up to 3.20 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:gb-50ada-a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
Show 28 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mitsubishi:gb-50ada-j_firmware:*:*:*:*:*:*:*:* | up to 3.20 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:gb-50ada-j:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:eb-50gu-a_firmware:*:*:*:*:*:*:*:* | up to 7.09 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:eb-50gu-a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:eb-50gu-j_firmware:*:*:*:*:*:*:*:* | up to 7.09 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:eb-50gu-j:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ae-200a_firmware:*:*:*:*:*:*:*:* | up to 7.93 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ae-200a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ae-200e_firmware:*:*:*:*:*:*:*:* | up to 7.93 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ae-200e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ae-50a_firmware:*:*:*:*:*:*:*:* | up to 7.93 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ae-50a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ae-50e_firmware:*:*:*:*:*:*:*:* | up to 7.93 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ae-50e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ew-50a_firmware:*:*:*:*:*:*:*:* | up to 7.93 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ew-50a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ew-50e_firmware:*:*:*:*:*:*:*:* | up to 7.93 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ew-50e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:te-200a_firmware:*:*:*:*:*:*:*:* | up to 7.93 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:te-200a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:te-50a_firmware:*:*:*:*:*:*:*:* | up to 7.93 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:te-50a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:tw-50a_firmware:*:*:*:*:*:*:*:* | up to 7.93 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:tw-50a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:cms-rmd-j_firmware:*:*:*:*:*:*:*:* | up to 1.30 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:cms-rmd-j:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:pac-yg50eca_firmware:*:*:*:*:*:*:*:* | up to 2.20 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:pac-yg50eca:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
- cpe:2.3:o:mitsubishi:gb-50ada-j_firmware:*:*:*:*:*:*:*:* Versions up to 3.20 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:gb-50ada-j:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:eb-50gu-a_firmware:*:*:*:*:*:*:*:* Versions up to 7.09 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:eb-50gu-a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:eb-50gu-j_firmware:*:*:*:*:*:*:*:* Versions up to 7.09 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:eb-50gu-j:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ae-200a_firmware:*:*:*:*:*:*:*:* Versions up to 7.93 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ae-200a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ae-200e_firmware:*:*:*:*:*:*:*:* Versions up to 7.93 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ae-200e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ae-50a_firmware:*:*:*:*:*:*:*:* Versions up to 7.93 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ae-50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ae-50e_firmware:*:*:*:*:*:*:*:* Versions up to 7.93 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ae-50e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ew-50a_firmware:*:*:*:*:*:*:*:* Versions up to 7.93 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ew-50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ew-50e_firmware:*:*:*:*:*:*:*:* Versions up to 7.93 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ew-50e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:te-200a_firmware:*:*:*:*:*:*:*:* Versions up to 7.93 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:te-200a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:te-50a_firmware:*:*:*:*:*:*:*:* Versions up to 7.93 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:te-50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:tw-50a_firmware:*:*:*:*:*:*:*:* Versions up to 7.93 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:tw-50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:cms-rmd-j_firmware:*:*:*:*:*:*:*:* Versions up to 1.30 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:cms-rmd-j:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:pac-yg50eca_firmware:*:*:*:*:*:*:*:* Versions up to 2.20 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:pac-yg50eca:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-20595
- 2026-10-03 Alias added: GHSA-rmww-xfp2-vx9m
References
More Mitsubishi Ae-200a Firmware vulnerabilities
- TI-2022-08177 Broken or risky cryptographic algorithm in Air Conditioning System G-150AD; Air… CVSS 3.1HIGH 7.5
- TI-2021-03826 Improper authentication in Air Conditioning System/Centralized Controllers G-50A; GB-50A… CVSS 3.1HIGH 7.1
Sources
- CVE-2021-20595 · CVE Program
- CVE-2021-20595 · NVD
- FIRST EPSS
- GHSA-rmww-xfp2-vx9m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences