Skip to content
Fencer Vulns
medium 6.1

CVE-2022-33322 json

Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, H…

published 2022-11-08 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-36365

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch and Air Purifier) allows a remote unauthenticated attacker to execute an malicious script on a user's browser to disclose information, etc. The wide range of models/versions of Mitsubishi Electric consumer electronics products are affected by this vulnerability. As for the affected product models/versions, see the Mitsubishi Electric's advisory which is listed in [References] section.

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

  • Mitsubishi Electric Corporation Air Conditioning MSZ-FD40/56/63/71/8022S
  • Mitsubishi Electric Corporation Air Conditioning MSZ-HXV25/28/40/56/63/71/8022S
  • Mitsubishi Electric Corporation Air Conditioning MSZ-VXV40/56/63/71/8022S
  • Mitsubishi Electric Corporation Air Conditioning MSZ-ZD25/28/40/56/63/71/8022(S)
  • Mitsubishi Electric Corporation Air Conditioning MSZ-FZ40/56/63/71/80/9021S
  • Mitsubishi Electric Corporation Air Conditioning MSZ-ZW22/25/28/36/40/56/63/71/80/9021(S)
  • Mitsubishi Electric Corporation Air Conditioning MSZ-FZV40/56/63/71/80/9021S
  • Mitsubishi Electric Corporation Air Conditioning MSZ-ZXV22/25/28/36/40/56/63/71/80/9021(S)
  • Mitsubishi Electric Corporation Air Conditioning MSZ-EM22/25/28/36/40/56/63/71/80/9021E9(S)
  • Mitsubishi Electric Corporation Air Conditioning MSZ-FZ40/56/63/71/80/9020S
  • Mitsubishi Electric Corporation Air Conditioning MSZ-ZW22/25/28/36/40/56/63/71/80/9020(S)
  • Mitsubishi Electric Corporation Air Conditioning MSZ-FZV40/56/63/71/80/9020S
  • Mitsubishi Electric Corporation Air Conditioning MSZ-ZXV22/25/28/36/40/56/63/71/80/9020(S)
  • Mitsubishi Electric Corporation Air Conditioning MSZ-EM22/25/28/36/40/56/63/71/80/9020E8(S)
  • Mitsubishi Electric Corporation Wi-Fi Interface MAC-900IF
  • Mitsubishi Electric Corporation Wi-Fi Interface PAC-SK43ML
  • Mitsubishi Electric Corporation Refrigerator MR-MXD50/57G
  • Mitsubishi Electric Corporation Refrigerator MR-WXD52/60/70G
  • Mitsubishi Electric Corporation Refrigerator MR-WZ55/61H
  • Mitsubishi Electric Corporation Refrigerator MR-MZ54/60H
  • Mitsubishi Electric Corporation HEMS adapter GT-HEM4
  • Mitsubishi Electric Corporation Wi-Fi Interface GT-RA1
  • Mitsubishi Electric Corporation Wi-Fi Interface GT-RA2
  • Mitsubishi Electric Corporation Wi-Fi Interface GT-HR1
  • Mitsubishi Electric Corporation Remote control with Wi-Fi Interface RMCB-H6SE-T
  • Mitsubishi Electric Corporation Remote control with Wi-Fi Interface RMCB-F6SE-T
  • Mitsubishi Electric Corporation Remote control with Wi-Fi Interface RMCB-D6SE-T
  • Mitsubishi Electric Corporation BATHROOM THERMO VENTILATOR V-241BZ-RC
  • Mitsubishi Electric Corporation BATHROOM THERMO VENTILATOR V-241BZ5-RC
  • Mitsubishi Electric Corporation BATHROOM THERMO VENTILATOR WD-240DK-RC
  • Mitsubishi Electric Corporation BATHROOM THERMO VENTILATOR WD-240DK2-RC
  • Mitsubishi Electric Corporation Rice cooker NJ-AWBX10
  • Mitsubishi Electric Corporation Mitsubishi Electric HEMS control adapter P-HM04WA
  • Mitsubishi Electric Corporation Wi-Fi Interface P-WA01
  • Mitsubishi Electric Corporation Energy Recovery Ventilator VL-200ZMHSV3-RC
  • Mitsubishi Electric Corporation Smart Switch P-1600SWRC
  • Mitsubishi Electric Corporation Smart Switch P-04SWRC
  • Mitsubishi Electric Corporation Smart Switch P-10SWRC
  • Mitsubishi Electric Corporation Wi-Fi Interface MAC-587IF-E
  • Mitsubishi Electric Corporation Wi-Fi Interface MAC-587IF2-E
  • Mitsubishi Electric Corporation Wi-Fi Interface MAC-507IF-E
  • Mitsubishi Electric Corporation Wi-Fi Interface MAC-588IF-E
  • Mitsubishi Electric Corporation Wi-Fi Interface S-MAC-002IF
  • Mitsubishi Electric Corporation Air Conditioning MSXY-FP05/07/10/13/18/20/24VGK-SG1
  • Mitsubishi Electric Corporation Air Conditioning MSY-GP10/13/15/18/20/24VFK-SG1
  • Mitsubishi Electric Corporation Air Conditioning MSZ-AP25/35/42/50VGK-E1
  • Mitsubishi Electric Corporation Air Conditioning MSZ-AP15/20/25/35/42/50/60/71VGK-E2
  • Mitsubishi Electric Corporation Air Conditioning MSZ-AP25/35/42/50/60/71VGK-E3
  • Mitsubishi Electric Corporation Air Conditioning MSZ-AP25/35/42/50VGK-E7
  • Mitsubishi Electric Corporation Air Conditioning MSZ-AP25/35/42/50VGK-E8

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.