CVE-2022-33322 Cross-site scripting in Air Conditioning MFZ-GXT50/60/73VFK
Remote unauthenticated attackers can execute malicious scripts in user browsers via XSS in Mitsubishi Electric consumer electronics, potentially disclosing information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-33322?
CVE-2022-33322 is a medium-severity cross-site scripting vulnerability in Mitsubishi Electric Corporation Air Conditioning MFZ-GXT50/60/73VFK, published on 8 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch and Air Purifier) allows a remote unauthenticated attacker to execute an malicious script on a user's browser to disclose information, etc. The wide range of models/versions of Mitsubishi Electric consumer electronics products are affected by this vulnerability. As for the affected product models/versions, see the Mitsubishi Electric's advisory which is listed in [References] section.
Weakness: CWE-79
Which versions are affected by CVE-2022-33322?
It affects 119 products.
Products include Mitsubishielectric Ma-Ew85s-E Firmware, Mitsubishielectric Ma-Ew85s-Uk Firmware, Mitsubishielectric Mac-507if-E Firmware, Mitsubishielectric Mac-587if-E Firmware, Mitsubishielectric Mac-587if2-E Firmware, Mitsubishielectric Mac-588if-E Firmware and 113 more.
How do I fix CVE-2022-33322?
No fix has been published for CVE-2022-33322 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-33322 being exploited?
There is no known exploitation of CVE-2022-33322 in the wild and no public exploit code.
Other vulnerabilities in Mitsubishi Electric Corporation Air Conditioning MFZ-GXT50/60/73VFK
Sources
Also known as GHSA-mhp9-hc33-rqwj.