Executive brief
A wide range of Mitsubishi Electric smart home appliances, including air conditioners, refrigerators, and water heaters, contain hard-coded Wi-Fi credentials. An attacker within physical Wi-Fi range of these devices can use these fixed credentials to gain unauthorized access. This could allow them to monitor device status (such as room temperature), modify appliance settings, or disable the device's wireless communication entirely.
Technical details
A Use of Hard-coded Credentials vulnerability (CWE-798) exists in various Mitsubishi Electric appliances and their associated Wireless LAN adapters. The devices utilize a fixed, hard-coded SSID and password for their initial setup or factory-default state. An attacker within Wi-Fi radio range can exploit this to authenticate to the device without authorization. Successful exploitation allows the attacker to read telemetry (operation status, temperatures), modify device or Wi-Fi configurations, or trigger a denial-of-service (DoS) condition on the Wi-Fi interface. The vulnerability primarily affects devices that have never been connected to a router or have been reset to factory defaults without subsequent reconfiguration. Firmware updates and workarounds are available from the vendor.
Affected products
- Mitsubishi Electric Corporation Room Air Conditioners (for Japan and outside Japan) 42.00 and prior
- Mitsubishi Electric Corporation Wireless LAN Adapters for Room Air Conditioners
- Mitsubishi Electric Corporation Wireless LAN Adapters for Packaged Air Conditioners
- Mitsubishi Electric Corporation Refrigerators (for Japan)
- Mitsubishi Electric Corporation Heat Pump Water Heaters / HEMS-Compatible Adapters / Wireless LAN Adapters (for Japan)
- Mitsubishi Electric Corporation Bathroom Dryer / Heater / Ventilation Systems (for Japan)
- Mitsubishi Electric Corporation Adapters for Airflow Ventilation Systems, Heat Pump Chilled / Hot Water Systems, and Ventilation / Air-Conditioning System Air Resorts (for Japan)
- Mitsubishi Electric Corporation Lossnay Central Ventilation Systems (for Japan)
- Mitsubishi Electric Corporation Smart Switches for Ventilation Fans and Lossnay (for Japan)
- Mitsubishi Electric Corporation IH Cooking Heaters (for Japan)
- Mitsubishi Electric Corporation Rice Cookers (for Japan)
Timeline
- 2026-06-15: advisory: Initial advisory published by JVN
- 2026-06-17: disclosed: CVE published and NVD entry created