Description
servlet/MIMEReceiveServlet in the web controller for Mitsubishi Electric GB-50 and GB-50A air-conditioning control systems allows remote attackers to cause a denial of service (air-conditioning outage) via an XML document containing a setRequest command.
References
- 28406 vdb-entry
- mitsubishielectric-gb50a-unath-access(41503) vdb-entry
- 3794 third-party-advisory
- 20080322 hacking the mitsubishi GB-50A mailing-list
- 20071117 security contact for mitsubishi electric? mailing-list