CVE-2008-1546 - servlet/MIMEReceiveServlet in the web controller for Mitsubishi Electric GB-50 and GB-50A air-condit

CVE-2008-1546

Summary

servlet/MIMEReceiveServlet in the web controller for Mitsubishi Electric GB-50 and GB-50A air-conditioning control systems allows remote attackers to cause a denial of service (air-conditioning outage) via an XML document containing a setRequest command.

References

Vulnerable Configurations

cpe:2.3:h:mitsubishi_electric:gb:50:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishi_electric:gb:50:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishi_electric:gb:50a:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishi_electric:gb:50a:*:*:*:*:*:*:*

CVSS

Base:	7.8 (as of 11-10-2018 - 20:35)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	COMPLETE

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:N/A:C

refmap via4

bid	28406
bugtraq	20071117 security contact for mitsubishi electric? 20080322 hacking the mitsubishi GB-50A
sreason	3794
xf	mitsubishielectric-gb50a-unath-access(41503)

Last major update

11-10-2018 - 20:35

Published

28-03-2008 - 23:44

Last modified

11-10-2018 - 20:35