No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
Credit: Mihály Csonka
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-3699 | CWE-306 Missing Authentication for Critical Function | 9.8 Critical |
An authentication bypass vulnerability exists in Mitsubishi Electric air conditioning systems. An attacker may bypass authentication to gain unauthorized control or access sensitive information stored within the system. The attacker may use the disclosed sensitive information to tamper with the firmware of the affected products. Mitigation: To minimize the risk of exploitation, ensure that air conditioning systems are configured according to Mitsubishi Electric's recommendations. Mitsubishi Electric recommends taking the following mitigation measures: Mitigation: Restrict access to air conditioning systems from untrusted networks and hosts. Mitigation: Restrict physical access to air conditioning systems, computers which can access them, and the network which is connected to them. Affected, fixed & timelineAffected:
Mitigation: Use antivirus software and ensure that the operating system and web browser are updated to the latest versions on computers that connect to air conditioning systems. Mitigation: Access restriction settings are available for the following models and versions. Depending on your environment, Mitsubishi Electric recommends enabling these settings to block access from untrusted hosts. Refer to section 6-3-3, ‘Access Restriction Settings,' in the Instruction Book – Initial Settings for usage instructions. Mitigation: The following models and versions support access restriction settings: Vendor fix: AE-200J Ver.8.03 or later Vendor fix: AE-200A Ver.8.03 or later Vendor fix: AE-200E Ver.8.03 or later Vendor fix: AE-50J Ver.8.03 or later Vendor fix: AE-50A Ver.8.03 or later Vendor fix: AE-50E Ver.8.03 or later Vendor fix: EW-50J Ver.8.03 or later Vendor fix: EW-50A Ver.8.03 or later Vendor fix: EW-50E Ver.8.03 or later Vendor fix: TE-200A Ver.8.03 or later Vendor fix: TE-50A Ver.8.03 or later Vendor fix: TW-50A Ver.8.03 or later Mitigation: Refer to Mitsubishi Electric's security bulletin for more information, including instructions for verifying the product version. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-3699 | 9.8 Critical | Mitsubishi Electric Corporation G-50 Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 all versions, G-50-W all versions, G-50A all versi… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.