CVE-2025-3699
Quick assessment
Affected
Mitsubishi Electric Corporation G-50
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mitsubishi Electric G-50等都是日本三菱电机（Mitsubishi Electric）公司的一款空调集中控制器。 Mitsubishi Electric多款产品存在访问控制错误漏洞，该漏洞源于缺少关键功能身份验证，可能导致非法控制空调系统或信息泄露。以下产品和版本受到影响：G-50 3.37及之前版本、G-50-W 3.37及之前版本、G-50A 3.37及之前版本、GB-50 3.37及之前版本、GB-50A 3.37及之前版本、GB-24A 9.12及之前版本、G-150AD 3
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1510 T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-3699
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 all versions, G-50-W all versions, G-50A all versions, GB-50 all versions, GB-50A all versions, GB-24A all versions, G-150AD all versions, AG-150A-A all versions, AG-150A-J all versions, GB-50AD all versions, GB-50ADA-A all versions, GB-50ADA-J all versions, EB-50GU-A all versions, EB-50GU-J all versions, AE-200J all versions, AE-200A all versions, AE-200E all versions, AE-50J all versions, AE-50A all versions, AE-50E all versions, EW-50J all versions, EW-50A all versions, EW-50E all versions, TE-200A all versions, TE-50A all versions, TW-50A all versions, and CMS-RMD-J all versions allows a remote unauthenticated attacker to bypass authentication and then control the air conditioning systems illegally, or disclose information in them by exploiting this vulnerability. In addition, the attacker may tamper with firmware for them using the disclosed information.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Mitsubishi Electric多款产品 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mitsubishi Electric G-50等都是日本三菱电机（Mitsubishi Electric）公司的一款空调集中控制器。 Mitsubishi Electric多款产品存在访问控制错误漏洞，该漏洞源于缺少关键功能身份验证，可能导致非法控制空调系统或信息泄露。以下产品和版本受到影响：G-50 3.37及之前版本、G-50-W 3.37及之前版本、G-50A 3.37及之前版本、GB-50 3.37及之前版本、GB-50A 3.37及之前版本、GB-24A 9.12及之前版本、G-150AD 3
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2025-3699
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-3699
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-3699 (2)
IV. Related Vulnerabilities
Same vendor: Mitsubishi Electric Corporation
-
CVE-2026-15688
Password Authentication Bypass Vulnerability in GX Works3 an -
CVE-2026-13584
Information tampering and Denial-of-service (DoS) vulnerabil -
CVE-2026-8806
Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series -
CVE-2026-8805
Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series -
CVE-2026-5667
Information Disclosure, Information Tampering, or Denial-of-
Same weakness: CWE-306
-
CVE-2026-105207
ZITADEL before 4.17.3 Account Takeover via External IdP Link -
CVE-2026-105115
OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instant -
CVE-2026-105105
Unauthenticated ZeroMQ command/telemetry bus in AIT-Core all -
CVE-2026-105049
Zilliz Attu<3.0.0 Playground未授权访问漏洞 -
CVE-2026-95102
Monta monta.app Missing Authentication for Critical Function
V. Comments for CVE-2025-3699
No comments yet