Security advisory affecting Mitsubishi Electric Air Conditioning Systems.

Forums › Gadgets, robotics, home automation, electronics (including wearables) › Security advisory affecting Mitsubishi Electric Air Conditioning Systems.

PolicyGuy

1820 posts

Uber Geek
+1 received by user: 1769

ID Verified

Lifetime subscriber

#296348 10-Jun-2022 08:51

The US Cybersecurity and Infrastructure Security Agency has issued an industrial control system advisory affecting Mitsubishi Electric Air Conditioning Systems.

If you have an Internet-accessible Mitsubishi Electric Air Conditioning System, you should probably do a firmware update:
https://www.cisa.gov/uscert/ics/advisories/icsa-22-160-01

Benjip

977 posts

Ultimate Geek
+1 received by user: 524

ID Verified

#2924572 10-Jun-2022 09:02

This is why I'd never get a heat pump with built-in WiFi – would far rather use something like Sensibo that gets updated regularly (with both security and feature updates).

KellyP

1250 posts

Uber Geek
+1 received by user: 115

ID Verified

Subscriber

#2924598 10-Jun-2022 09:48

Thanks - is this for units with built in wifi? My unit is an add on.

That list is mainly large scale commerical units.

cyril7

9073 posts

Uber Geek
+1 received by user: 2499

ID Verified

Trusted

Subscriber

#2924607 10-Jun-2022 10:06

Hi I just got a Mitsubishi installed and it came with the plugin wifi unit, which works great by the way, and is an NZ developed product. It does not seem related to this vunerability.

Cyril

neb

11294 posts

Uber Geek
+1 received by user: 10018

Trusted

Lifetime subscriber

#2925126 11-Jun-2022 10:00

PolicyGuy:
The US Cybersecurity and Infrastructure Security Agency has issued an industrial control system advisory affecting Mitsubishi Electric Air Conditioning Systems.

That should say "yet another advisory", Mitsubishi have a long history of vulns in their AC control systems, problems with malformed requests, XXE, broken authentication, ... . From a scan of the latest series of vulns it looks like they're using an ancient, insecure SSL/TLS implementation.

To see if you're vulnerable, point the Qualys scanner at your host. Given the way the vulns are listed (Sweet32 really isn't a problem in this case), it looks like they were generated by someone running a different scanner on one of the controllers.