In today’s world, the “Internet of Things” (IoT) is in our homes—from smart air conditioners to kitchen appliances. But with innovation comes risk, and sometimes big brands, like Mitsubishi Electric, make mistakes in how they secure these household gadgets. One of the most important vulnerabilities discovered recently is CVE-2022-33321, which exposes sensitive customer information over the network.

If you own a Mitsubishi Electric smart home appliance—like a Wi-Fi-enabled air conditioner, a fridge, a smart range hood, or even a rice cooker—you could be affected. In this article, we’ll break down what the vulnerability is, what devices are impacted, how it can be exploited (simply!), demo a proof of concept, and show you where to learn more.

The Basics

CVE-2022-33321 is a flaw in how several Mitsubishi Electric smart devices communicate over the network. Instead of using encrypted protocols like HTTPS, many of these devices use basic HTTP for connections—transmitting usernames and passwords in the clear, using “Basic Authentication.”

Why Is This Bad?

When your device sends its Wi-Fi login or account info as plain text, anyone on the same network (like a hacker nearby or someone controlling a public Wi-Fi) can “sniff” the data. With the right tools, an attacker can read your credentials as they pass over the air, giving them access to control your appliances—or worse, use them to launch bigger attacks.

Air Purifier

For an official and complete list of affected models/versions, refer to Mitsubishi Electric's advisory in References.

How Does the Exploit Work?

The vulnerability is simple: when the device connects to a mobile app or cloud server, it uses Basic Authentication over HTTP. This means that the data is basically just “base64-encoded”—not encrypted.

Anyone with a packet sniffer (like Wireshark) can see the username and password in just a few clicks.

Example Protocol Capture

Suppose someone is connecting their Mitsubishi Electric air conditioner app on their smartphone to the Wi-Fi controller. The app requests access like this:

POST /login HTTP/1.1
Host: 192.168.1.100
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
Content-Type: application/json

That Authorization line is "Basic" authentication. The string after it is base64-encoded, not encrypted.

Decode it, and you get

echo "dXNlcm5hbWU6cGFzc3dvcmQ=" | base64 --decode
# Output: username:password

Proof of Concept (PoC)

Let’s see how a real attacker could grab your info.

tcpdump Example

sudo tcpdump -i wlan -A port 80

Exploitation Impact

- Unauthorized control of devices (attackers can turn off/on appliances, change settings)

Mitigation Advice

- Update Firmware: Follow Mitsubishi Electric’s official advisory and update your devices where possible. Patches may be available for some product lines.
- Limit Network Exposure: Avoid connecting your smart appliances to public Wi-Fi or guest networks.
- Network Segmentation: Put smart appliances on their own VLAN or network segment, separate from sensitive computers.

Official Advisory & References

- Mitsubishi Electric’s Security Advisory (PDF)
- Japan Vuls Notes - JVNVU#97131368
- NIST NVD Entry CVE-2022-33321

Conclusion

CVE-2022-33321 shows how even top-tier consumer brands can make basic, preventable mistakes that put users at risk. As we embrace the convenience of smart homes, we must also demand better security from our devices and stay alert to advisories.

If you own a Mitsubishi Electric IoT appliance, check updates regularly, isolate them on your network, and avoid public Wi-Fi at all costs. It might be time to ask your favorite appliance-maker: “How are you protecting my home?”


> *Stay safe, and always follow security news for your smart devices!*

If you want more content like this, let us know what products you’re worried about next.

Timeline

Published on: 11/08/2022 20:15:00 UTC
Last modified on: 01/09/2023 19:48:00 UTC