CVE-2021-20595: Mitsubishi Ae-200a Firmware

High severity, CVSS 8.2. EPSS: 1.8% chance of exploitation in the next 30 days.

Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.3.35 and prior, GB-50A Ver.3.35 and prior, GB-24A Ver.9.11 and prior, AG-150A-A Ver.3.20 and prior, AG-150A-J Ver.3.20 and prior, GB-50ADA-A Ver.3.20 and prior, GB-50ADA-J Ver.3.20 and prior, EB-50GU-A Ver 7.09 and prior, EB-50GU-J Ver 7.09 and prior, AE-200A Ver 7.93 and prior, AE-200E Ver 7.93 and prior, AE-50A Ver 7.93 and prior, AE-50E Ver 7.93 and prior, EW-50A Ver 7.93 and prior, EW-50E Ver 7.93 and prior, TE-200A Ver 7.93 and prior, TE-50A Ver 7.93 and prior, TW-50A Ver 7.93 and prior, CMS-RMD-J Ver.1.30 and prior), Air Conditioning System/Expansion Controllers (PAC-YG50ECA Ver.2.20 and prior) and Air Conditioning System/BM adapter(BAC-HD150 Ver.2.21 and prior) allows a remote unauthenticated attacker to disclose some of data in the air conditioning system or cause a DoS condition by sending specially crafted packets.

Affected products

  • Mitsubishi Ae-200a Firmware: up to and including 7.93
  • Mitsubishi Ae-200e Firmware: up to and including 7.93
  • Mitsubishi Ae-50a Firmware: up to and including 7.93
  • Mitsubishi Ae-50e Firmware: up to and including 7.93
  • Mitsubishi AG-150a-A Firmware: up to and including 3.20
  • Mitsubishi AG-150a-J Firmware: up to and including 3.20
  • Mitsubishi CMS-Rmd-J Firmware: up to and including 1.30
  • Mitsubishi Eb-50gu-A Firmware: up to and including 7.09
  • Mitsubishi Eb-50gu-J Firmware: up to and including 7.09
  • Mitsubishi Ew-50a Firmware: up to and including 7.93
  • Mitsubishi Ew-50e Firmware: up to and including 7.93
  • Mitsubishi G-50a Firmware: from 2.50, up to and including 3.35
  • Mitsubishi Gb-50a Firmware: from 2.50, up to and including 3.35
  • Mitsubishi Gb-50ada-A Firmware: up to and including 3.20
  • Mitsubishi Gb-50ada-J Firmware: up to and including 3.20
  • Mitsubishi Pac-YG50ECA Firmware: up to and including 2.20
  • Mitsubishi Te-200a Firmware: up to and including 7.93
  • Mitsubishi Te-50a Firmware: up to and including 7.93
  • Mitsubishi Tw-50a Firmware: up to and including 7.93

Published 2021-07-13. Last modified 2026-06-17.