CVE-2026-5667: Information Disclosure, Information Tampering, or Denial-of-Service (DoS) Vulnerability in Multiple Home Appliances

Synopsis

Use of hard-coded credentials in Mitsubishi Electric Room Air Conditioners (and related home appliance wireless adapters) allows an attacker within Wi-Fi radio range to authenticate using a fixed, embedded SSID and password baked into the device firmware. No user account or prior access is required; the attacker only needs to be close enough to reach the device's Wi-Fi signal. Successful exploitation enables reading device state (operation status, set temperature, room temperature), changing air-conditioner or Wi-Fi settings, or disrupting Wi-Fi communication entirely. No fix version has been published; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as Mitsubishi Electric releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be within Wi-Fi radio range of the affected device; no internet-routable path is needed, but physical or adjacent-network proximity (LAN or local wireless broadcast area) is required.

• AuthenticationNot required

  The hard-coded SSID and password are embedded in the device firmware, so no legitimate credentials or account are needed to authenticate.

• Victim interactionNot required

  Exploitation is entirely attacker-driven; no action by a device owner or user is required.

• Attack complexityDetail

  Attack complexity is low: the exploit requires no race conditions, special timing, or environmental setup beyond being in Wi-Fi range and knowing the hard-coded credentials.

Blast Radius

• Reads device operational data including current operation status, room set temperature, and room temperature.
• Modifies air-conditioner settings (such as target temperature or operating mode) or reconfigures Wi-Fi network settings on the device.
• Disrupts Wi-Fi communication for the affected device, causing a denial-of-service condition for any networked functionality that depends on it.
• Impact is contained to the affected device itself; the CVSS v4.0 vector indicates no confidentiality, integrity, or availability impact on downstream or connected systems beyond the device.