CVE-2026-5667 Information Disclosure, Information Tampering, or Denial-of-Service (DoS) Vulnerability in Multiple Home Appliances
Attackers within Wi-Fi range can access Mitsubishi home appliances using hard-coded credentials to read data, modify settings, or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-5667?
CVE-2026-5667 is a high-severity vulnerability in Mitsubishi Electric Corporation Adapters for Airflow Ventilation Systems, Heat Pump Chilled/Hot Water Systems, and Ventilation/Air-Conditioning System Air Resorts (for Japan) HM-01A-EX, published on 17 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for Japan and outside Japan); Wireless LAN Adapters for Room Air Conditioners (for Japan and outside Japan); Wireless LAN Adapters for Packaged Air Conditioners (for Japan and outside Japan); Refrigerators (for Japan); Heat Pump Water Heaters / HEMS-Compatible Adapters / Wireless LAN Adapters (for Japan); Bathroom Dryer / Heater / Ventilation Systems (for Japan); Adapters for Airflow Ventilation Systems, Heat Pump Chilled / Hot Water Systems, and Ventilation / Air-Conditioning System Air Resorts (for Japan); Lossnay Central Ventilation Systems (for Japan); Smart Switches for Ventilation Fans and Lossnay (for Japan); IH Cooking Heaters (for Japan); and Rice Cookers (for Japan) allows an attacker within Wi-Fi radio range of an affected product to access the affected product using a hard-coded SSID and password, thereby obtaining device data such as operation status, room set temperature, and room temperature; changing the air-conditioner or Wi-Fi settings; or causing Wi-Fi communication to enter a denial-of-service (DoS) condition.
Weakness: CWE-798
Which versions are affected by CVE-2026-5667?
How do I fix CVE-2026-5667?
No fix has been published for CVE-2026-5667 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-5667 being exploited?
There is no known exploitation of CVE-2026-5667 in the wild and no public exploit code.
Sources
Also known as GHSA-v4fv-4v3p-rhf8.