Skip to content
Fencer Vulns
high 7.5

CVE-2022-24296 json

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver.

published 2022-06-08 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-29197

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver. 3.21 and prior, Air Conditioning System AG-150A-A Ver. 3.21 and prior, Air Conditioning System AG-150A-J Ver. 3.21 and prior, Air Conditioning System GB-50AD Ver. 3.21 and prior, Air Conditioning System GB-50ADA-A Ver. 3.21 and prior, Air Conditioning System GB-50ADA-J Ver. 3.21 and prior, Air Conditioning System EB-50GU-A Ver. 7.10 and prior, Air Conditioning System EB-50GU-J Ver. 7.10 and prior, Air Conditioning System AE-200J Ver. 7.97 and prior, Air Conditioning System AE-200A Ver. 7.97 and prior, Air Conditioning System AE-200E Ver. 7.97 and prior, Air Conditioning System AE-50J Ver. 7.97 and prior, Air Conditioning System AE-50A Ver. 7.97 and prior, Air Conditioning System AE-50E Ver. 7.97 and prior, Air Conditioning System EW-50J Ver. 7.97 and prior, Air Conditioning System EW-50A Ver. 7.97 and prior, Air Conditioning System EW-50E Ver. 7.97 and prior, Air Conditioning System TE-200A Ver. 7.97 and prior, Air Conditioning System TE-50A Ver. 7.97 and prior and Air Conditioning System TW-50A Ver. 7.97 and prior allows a remote unauthenticated attacker to cause a disclosure of encrypted message of the air conditioning systems by sniffing encrypted communications.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-160-01 updated cvss 3.1

Mitsubishi Electric Air Conditioning Systems

  • Mitsubishi Electric AE-50A <= 7.97 Mitsubishi Electric AE-50E <= 7.97 Mitsubishi Electric AE-50J <= 7.97 Mitsubishi Electric AE-200A <= 7.97 Mitsubishi Electric AE-200E <= 7.97 Mitsubishi Electric AE-200J <= 7.97
    +14 more products
    Mitsubishi Electric AG-150A-A <= 3.21 Mitsubishi Electric AG-150A-J <= 3.21 Mitsubishi Electric EB-50GU-A <= 7.10 Mitsubishi Electric EB-50GU-J <= 7.10 Mitsubishi Electric EW-50A <= 7.97 Mitsubishi Electric EW-50E <= 7.97 Mitsubishi Electric EW-50J <= 7.97 Mitsubishi Electric G-150AD <= 3.21 Mitsubishi Electric GB-50AD <= 3.21 Mitsubishi Electric GB-50ADA-A <= 3.21 Mitsubishi Electric GB-50ADA-J <= 3.21 Mitsubishi Electric TE-50A <= 7.97 Mitsubishi Electric TE-200A <= 7.97 Mitsubishi Electric TW-50A <= 7.97
    affected: fixed in 7.98, mitigation “G-150AD: Replace the air conditioning systems to AE-200J, AE-50J or EW-50J Version 7.98 or later” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.17% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • n/a Air Conditioning System G-150AD; Air Conditioning System AG-150A-A; Air Conditioning System AG-150A-J; Air Conditioning System GB-50AD; Air Conditioning System GB-50ADA-A; Air Conditioning System GB-50ADA-J; Air Conditioning System EB-50GU-A; Air Conditioning System EB-50GU-J; Air Conditioning System AE-200J; Air Conditioning System AE-200A; Air Conditioning System AE-200E; Air Conditioning System AE-50J; Air Conditioning System AE-50A; Air Conditioning System AE-50E; Air Conditioning System EW-50J; Air Conditioning System EW-50A; Air Conditioning System EW-50E; Air Conditioning System TE-200A; Air Conditioning System TE-50A; Air Conditioning System TW-50A

Classification

Weakness
  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.