CVE-2025-3699
June 27, 2025, 10:15 a.m.
9.8
Critical
Description
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 Version 3.37 and prior, G-50-W Version 3.37 and prior, G-50A Version 3.37 and prior, GB-50 Version 3.37 and prior, GB-50A Version 3.37 and prior, GB-24A Version 9.12 and prior, G-150AD Version 3.21 and prior, AG-150A-A Version 3.21 and prior, AG-150A-J Version 3.21 and prior, GB-50AD Version 3.21 and prior, GB-50ADA-A Version 3.21 and prior, GB-50ADA-J Version 3.21 and prior, EB-50GU-A Version 7.11 and prior, EB-50GU-J Version 7.11 and prior, AE-200J Version 8.01 and prior, AE-200A Version 8.01 and prior, AE-200E Version 8.01 and prior, AE-50J Version 8.01 and prior, AE-50A Version 8.01 and prior, AE-50E Version 8.01 and prior, EW-50J Version 8.01 and prior, EW-50A Version 8.01 and prior, EW-50E Version 8.01 and prior, TE-200A Version 8.01 and prior, TE-50A Version 8.01 and prior, TW-50A Version 8.01 and prior, and CMS-RMD-J Version 1.40 and prior allows a remote unauthenticated attacker to bypass authentication and then control the air conditioning systems illegally, or disclose information in them by exploiting this vulnerability. In addition, the attacker may tamper with firmware for them using the disclosed information.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
| Mitsubishi Electric |
|
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
*CPE(s)
Affected systems and software identified for this CVE.
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | mitsubishi_electric | g-50 | 3.37 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | g-50-w | 3.37 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | g-50a | 3.37 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | gb-50 | 3.37 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | gb-50a | 3.37 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | gb-24a | 9.12 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | g-150ad | 3.21 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | ag-150a-a | 3.21 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | ag-150a-j | 3.21 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | gb-50ad | 3.21 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | gb-50ada-a | 3.21 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | gb-50ada-j | 3.21 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | eb-50gu-a | 7.11 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | eb-50gu-j | 7.11 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | ae-200j | 8.01 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | ae-200a | 8.01 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | ae-200e | 8.01 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | ae-50j | 8.01 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | ae-50a | 8.01 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | ae-50e | 8.01 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | ew-50j | 8.01 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | ew-50a | 8.01 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | ew-50e | 8.01 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | te-200a | 8.01 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | te-50a | 8.01 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | tw-50a | 8.01 | / | / | / | / | / | / | / |
| a | mitsubishi_electric | cms-rmd-j | 1.40 | / | / | / | / | / | / | / |
Tags
CVSS Score
CVSS Data - 3.1
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: NONE
- Scope: UNCHANGED
- Confidentiality Impact: HIGH
- Integrity Impact: HIGH
- Availability Impact: HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
Published: June 26, 2025, 11:15 p.m.
Last Modified: June 27, 2025, 10:15 a.m.
Last Modified: June 27, 2025, 10:15 a.m.
Status : Received
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.