CVE-2025-3699 
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 all versions, G-50-W all versions, G-50A all versions, GB-50 all versions, GB-50A all versions, GB-24A all versions, G-150AD all versions, AG-150A-A all versions, AG-150A-J all versions, GB-50AD all versions, GB-50ADA-A all versions, GB-50ADA-J all versions, EB-50GU-A all versions, EB-50GU-J all versions, AE-200J all versions, AE-200A all versions, AE-200E all versions, AE-50J all versions, AE-50A all versions, AE-50E all versions, EW-50J all versions, EW-50A all versions, EW-50E all versions, TE-200A all versions, TE-50A all versions, TW-50A all versions, and CMS-RMD-J all versions allows a remote unauthenticated attacker to bypass authentication and then control the air conditioning systems illegally, or disclose information in them by exploiting this vulnerability. In addition, the attacker may tamper with firmware for them using the disclosed information.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Mitsubishi Electric Corporation
product: G-50
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: G-50-W
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: G-50A
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: GB-50
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: GB-50A
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: GB-24A
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: G-150AD
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: AG-150A-A
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: AG-150A-J
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: GB-50AD
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: GB-50ADA-A
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: GB-50ADA-J
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: EB-50GU-A
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: EB-50GU-J
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: AE-200J
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: AE-200A
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: AE-200E
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: AE-50J
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: AE-50A
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: AE-50E
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: EW-50J
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: EW-50A
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: EW-50E
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: TE-200A
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: TE-50A
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: TW-50A
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: CMS-RMD-J
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-06-26T22:40:37.915Z