Broken or risky cryptographic algorithm in Air Conditioning System G-150AD; Air…
Priority LOW 35CWE-327Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-327.
Summary
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver. 3.21 and prior, Air Conditioning System AG-150A-A Ver. 3.21 and prior, Air Conditioning System AG-150A-J Ver. 3.21 and prior, Air Conditioning System GB-50AD Ver. 3.21 and prior, Air Conditioning System GB-50ADA-A Ver. 3.21 and prior, Air Conditioning System GB-50ADA-J Ver. 3.21 and prior, Air Conditioning System EB-50GU-A Ver. 7.10 and prior, Air Conditioning System EB-50GU-J Ver. 7.10 and prior, Air Conditioning System AE-200J Ver. 7.97 and prior, Air Conditioning System AE-200A Ver. 7.97 and prior, Air Conditioning System AE-200E Ver. 7.97 and prior, Air Conditioning System AE-50J Ver. 7.97 and prior, Air Conditioning System AE-50A Ver. 7.97 and prior, Air Conditioning System AE-50E Ver. 7.97 and prior, Air Conditioning System EW-50J Ver. 7.97 and prior, Air Conditioning System EW-50A Ver. 7.97 and prior, Air Conditioning System EW-50E Ver. 7.97 and prior, Air Conditioning System TE-200A Ver. 7.97 and prior, Air Conditioning System TE-50A Ver. 7.97 and prior and Air Conditioning System TW-50A Ver. 7.97 and prior allows a remote unauthenticated attacker to cause a disclosure of encrypted message of the air conditioning systems by sniffing encrypted communications.
Why it matters now
EPSS 0.01167 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Air Conditioning System G-150AD; Air Conditioning System AG-150A-A; Air Conditioning System AG-150A-J; Air Conditioning System GB-50AD; Air Conditioning System GB-50ADA-A; Air Conditioning System GB-50ADA-J; Air Conditioning System EB-50GU-A; Air Conditioning System EB-50GU-J; Air Conditioning System AE-200J; Air Conditioning System AE-200A; Air Conditioning System AE-200E; Air Conditioning System AE-50J; Air Conditioning System AE-50A; Air Conditioning System AE-50E; Air Conditioning System EW-50J; Air Conditioning System EW-50A; Air Conditioning System EW-50E; Air Conditioning System TE-200A; Air Conditioning System TE-50A; Air Conditioning System TW-50A | Air Conditioning System G-150AD Ver. 3.21 and prior; Air Conditioning System AG-150A-A Ver. 3.21 and prior; Air Conditioning System AG-150A-J Ver. 3.21 and prior; Air Conditioning System GB-50AD Ver. 3.21 and prior; Air Conditioning System GB-50ADA-A Ver. 3.21 and prior; Air Conditioning System GB-50ADA-J Ver. 3.21 and prior; Air Conditioning System EB-50GU-A Ver. 7.10 and prior; Air Conditioning System EB-50GU-J Ver. 7.10 and prior; Air Conditioning System AE-200J Ver. 7.97 and prior; Air Conditioning System AE-200A Ver. 7.97 and prior; Air Conditioning System AE-200E Ver. 7.97 and prior; Air Conditioning System AE-50J Ver. 7.97 and prior; Air Conditioning System AE-50A Ver. 7.97 and prior; Air Conditioning System AE-50E Ver. 7.97 and prior; Air Conditioning System EW-50J Ver. 7.97 and prior; Air Conditioning System EW-50A Ver. 7.97 and prior; Air Conditioning System EW-50E Ver. 7.97 and prior; Air Conditioning System TE-200A Ver. 7.97 and prior; Air Conditioning System TE-50A Ver. 7.97 and prior; Air Conditioning System TW-50A Ver. 7.97 and prior | — | No fix listed | CNA |
- Air Conditioning System G-150AD; Air Conditioning System AG-150A-A; Air Conditioning System AG-150A-J; Air Conditioning System GB-50AD; Air Conditioning System GB-50ADA-A; Air Conditioning System GB-50ADA-J; Air Conditioning System EB-50GU-A; Air Conditioning System EB-50GU-J; Air Conditioning System AE-200J; Air Conditioning System AE-200A; Air Conditioning System AE-200E; Air Conditioning System AE-50J; Air Conditioning System AE-50A; Air Conditioning System AE-50E; Air Conditioning System EW-50J; Air Conditioning System EW-50A; Air Conditioning System EW-50E; Air Conditioning System TE-200A; Air Conditioning System TE-50A; Air Conditioning System TW-50A Vendor— Affected Air Conditioning System G-150AD Ver. 3.21 and prior; Air Conditioning System AG-150A-A Ver. 3.21 and prior; Air Conditioning System AG-150A-J Ver. 3.21 and prior; Air Conditioning System GB-50AD Ver. 3.21 and prior; Air Conditioning System GB-50ADA-A Ver. 3.21 and prior; Air Conditioning System GB-50ADA-J Ver. 3.21 and prior; Air Conditioning System EB-50GU-A Ver. 7.10 and prior; Air Conditioning System EB-50GU-J Ver. 7.10 and prior; Air Conditioning System AE-200J Ver. 7.97 and prior; Air Conditioning System AE-200A Ver. 7.97 and prior; Air Conditioning System AE-200E Ver. 7.97 and prior; Air Conditioning System AE-50J Ver. 7.97 and prior; Air Conditioning System AE-50A Ver. 7.97 and prior; Air Conditioning System AE-50E Ver. 7.97 and prior; Air Conditioning System EW-50J Ver. 7.97 and prior; Air Conditioning System EW-50A Ver. 7.97 and prior; Air Conditioning System EW-50E Ver. 7.97 and prior; Air Conditioning System TE-200A Ver. 7.97 and prior; Air Conditioning System TE-50A Ver. 7.97 and prior; Air Conditioning System TW-50A Ver. 7.97 and prior Fixed in — No fix listed CNA
CPE configurations NVD · 40
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mitsubishi:ae-200a_firmware:*:*:*:*:*:*:*:* | up to 7.97 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ae-200a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ae-200e_firmware:*:*:*:*:*:*:*:* | up to 7.97 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ae-200e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ae-200j_firmware:*:*:*:*:*:*:*:* | up to 7.97 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ae-200j:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ae-50a_firmware:*:*:*:*:*:*:*:* | up to 7.97 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ae-50a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ae-50e_firmware:*:*:*:*:*:*:*:* | up to 7.97 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ae-50e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
- cpe:2.3:o:mitsubishi:ae-200a_firmware:*:*:*:*:*:*:*:* Versions up to 7.97 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ae-200a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ae-200e_firmware:*:*:*:*:*:*:*:* Versions up to 7.97 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ae-200e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ae-200j_firmware:*:*:*:*:*:*:*:* Versions up to 7.97 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ae-200j:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ae-50a_firmware:*:*:*:*:*:*:*:* Versions up to 7.97 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ae-50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ae-50e_firmware:*:*:*:*:*:*:*:* Versions up to 7.97 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ae-50e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
Show 30 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mitsubishi:ae-50j_firmware:*:*:*:*:*:*:*:* | up to 7.97 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ae-50j:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ag-150a-a_firmware:*:*:*:*:*:*:*:* | up to 3.21 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ag-150a-a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ag-150a-j_firmware:*:*:*:*:*:*:*:* | up to 3.21 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ag-150a-j:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:eb-50gu-a_firmware:*:*:*:*:*:*:*:* | up to 7.10 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:eb-50gu-a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:eb-50gu-j_firmware:*:*:*:*:*:*:*:* | up to 7.10 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:eb-50gu-j:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ew-50a_firmware:*:*:*:*:*:*:*:* | up to 7.97 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ew-50a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ew-50e_firmware:*:*:*:*:*:*:*:* | up to 7.97 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ew-50e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:ew-50j_firmware:*:*:*:*:*:*:*:* | up to 7.97 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:ew-50j:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:g-150ad_firmware:*:*:*:*:*:*:*:* | up to 3.21 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:g-150ad:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:gb-50a_firmware:*:*:*:*:*:*:*:* | up to 3.21 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:gb-50a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:gb-50ada-a_firmware:*:*:*:*:*:*:*:* | up to 3.21 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:gb-50ada-a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:gb-50ada-j_firmware:*:*:*:*:*:*:*:* | up to 3.21 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:gb-50ada-j:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:te-200a_firmware:*:*:*:*:*:*:*:* | up to 7.97 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:te-200a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:te-50a_firmware:*:*:*:*:*:*:*:* | up to 7.97 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:te-50a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
| cpe:2.3:o:mitsubishi:tw-50a_firmware:*:*:*:*:*:*:*:* | up to 7.97 | Vulnerable | Mitsubishi |
| cpe:2.3:h:mitsubishi:tw-50a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Mitsubishi |
- cpe:2.3:o:mitsubishi:ae-50j_firmware:*:*:*:*:*:*:*:* Versions up to 7.97 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ae-50j:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ag-150a-a_firmware:*:*:*:*:*:*:*:* Versions up to 3.21 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ag-150a-a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ag-150a-j_firmware:*:*:*:*:*:*:*:* Versions up to 3.21 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ag-150a-j:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:eb-50gu-a_firmware:*:*:*:*:*:*:*:* Versions up to 7.10 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:eb-50gu-a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:eb-50gu-j_firmware:*:*:*:*:*:*:*:* Versions up to 7.10 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:eb-50gu-j:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ew-50a_firmware:*:*:*:*:*:*:*:* Versions up to 7.97 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ew-50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ew-50e_firmware:*:*:*:*:*:*:*:* Versions up to 7.97 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ew-50e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:ew-50j_firmware:*:*:*:*:*:*:*:* Versions up to 7.97 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:ew-50j:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:g-150ad_firmware:*:*:*:*:*:*:*:* Versions up to 3.21 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:g-150ad:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:gb-50a_firmware:*:*:*:*:*:*:*:* Versions up to 3.21 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:gb-50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:gb-50ada-a_firmware:*:*:*:*:*:*:*:* Versions up to 3.21 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:gb-50ada-a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:gb-50ada-j_firmware:*:*:*:*:*:*:*:* Versions up to 3.21 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:gb-50ada-j:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:te-200a_firmware:*:*:*:*:*:*:*:* Versions up to 7.97 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:te-200a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:te-50a_firmware:*:*:*:*:*:*:*:* Versions up to 7.97 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:te-50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
- cpe:2.3:o:mitsubishi:tw-50a_firmware:*:*:*:*:*:*:*:* Versions up to 7.97 Vulnerable ·Mitsubishi
- cpe:2.3:h:mitsubishi:tw-50a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mitsubishi
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24296
- 2026-10-03 Alias added: GHSA-9mwc-7fwx-973c
References
More Mitsubishi Ae-200a Firmware vulnerabilities
- TI-2021-03828 XML external entity injection in Air Conditioning System/Centralized Controllers G-50A… CVSS 3.1HIGH 8.2
- TI-2021-03826 Improper authentication in Air Conditioning System/Centralized Controllers G-50A; GB-50A… CVSS 3.1HIGH 7.1
Sources
- CVE-2022-24296 · CVE Program
- CVE-2022-24296 · NVD
- FIRST EPSS
- GHSA-9mwc-7fwx-973c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences