CVE-2022-33322
Quick assessment
Affected
Mitsubishi Electric Corporation Air Conditioning MSZ-FD40/56/63/71/8022S
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mitsubishi Electric consumer electronics products是日本三菱电机（Mitsubishi Electric）公司的一系列消费电子产品。 Mitsubishi Electric consumer electronics products存在安全漏洞，该漏洞源于允许未经身份验证的远程攻击者在用户浏览器上执行恶意脚本从而导致泄露信息等。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-33322
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch and Air Purifier) allows a remote unauthenticated attacker to execute an malicious script on a user's browser to disclose information, etc. The wide range of models/versions of Mitsubishi Electric consumer electronics products are affected by this vulnerability. As for the affected product models/versions, see the Mitsubishi Electric's advisory which is listed in [References] section.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Mitsubishi Electric consumer electronics products 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mitsubishi Electric consumer electronics products是日本三菱电机（Mitsubishi Electric）公司的一系列消费电子产品。 Mitsubishi Electric consumer electronics products存在安全漏洞，该漏洞源于允许未经身份验证的远程攻击者在用户浏览器上执行恶意脚本从而导致泄露信息等。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-33322
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-33322
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-33322 (1)
-
https://jvn.jp/vu/JVNVU96767562/index.html government-resource
Other References for CVE-2022-33322 (2)
IV. Related Vulnerabilities
Same vendor: Mitsubishi Electric Corporation
-
CVE-2026-13584
Information tampering and Denial-of-service (DoS) vulnerabil -
CVE-2026-8806
Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series -
CVE-2026-8805
Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series -
CVE-2026-5667
Information Disclosure, Information Tampering, or Denial-of- -
CVE-2025-14816
Information Disclosure, Tampering, and Denial-of-Service Vul
Same weakness: CWE-79
-
CVE-2026-8630
justhtml before 1.12.0 Mutation XSS via Raw Text Elements -
CVE-2026-8445
justhtml before 1.12.0 Sanitizer Bypass via Markdown -
CVE-2026-77088
justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code- -
CVE-2026-74793
justhtml before 3.11.0 XSS via selectedcontent projection -
CVE-2026-6827
justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnera
V. Comments for CVE-2022-33322
No comments yet