Hard-Coded Credentials Vulnerability in Mitsubishi Electric Room Air Conditioners and Related Products
CVE-2026-5667

7.2HIGH

Key Information:

Vendor

Mitsubishi Electric Corporation

Status
Room Air Conditioners (for Japan) Msz-bkr2223-w
Room Air Conditioners (for Japan) Msz-bkr2224-w
Room Air Conditioners (for Japan) Msz-bkr2523-w
Room Air Conditioners (for Japan) Msz-bkr2524-w
Vendor
CVE Published:
17 June 2026

What is CVE-2026-5667?

A vulnerability exists within various Mitsubishi Electric products, allowing an attacker within Wi-Fi range to exploit hard-coded credentials. This access enables unauthorized retrieval of operation statuses, room temperature settings, and modification of configuration settings. Furthermore, attackers can disrupt Wi-Fi communications, leading to potential denial-of-service conditions, thereby compromising the functional integrity of the affected devices.

Affected Version(s)

Adapters for Airflow Ventilation Systems, Heat Pump Chilled/Hot Water Systems, and Ventilation/Air-Conditioning System Air Resorts (for Japan) HM-01A-EX 01.14 and prior

Adapters for Airflow Ventilation Systems, Heat Pump Chilled/Hot Water Systems, and Ventilation/Air-Conditioning System Air Resorts (for Japan) P-01HMA 01.14 and prior

Adapters for Airflow Ventilation Systems, Heat Pump Chilled/Hot Water Systems, and Ventilation/Air-Conditioning System Air Resorts (for Japan) P-HM02WA 01.14 and prior

References

https://www.mitsubishielectric.com/psirt/vulnerability/pd...
vendor-advisory
https://jvn.jp/vu/JVNVU99620284/
government-resource

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.