CVE-2022-24296

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver. 3.21 and prior, Air Conditioning System AG-150A-A Ver. 3.21 and prior, Air Conditioning System AG-150A-J Ver. 3.21 and prior, Air Conditioning System GB-50AD Ver. 3.21 and prior, Air Conditioning System GB-50ADA-A Ver. 3.21 and prior, Air Conditioning System GB-50ADA-J Ver. 3.21 and prior, Air Conditioning System EB-50GU-A Ver. 7.10 and prior, Air Conditioning System EB-50GU-J Ver. 7.10 and prior, Air Conditioning System AE-200J Ver. 7.97 and prior, Air Conditioning System AE-200A Ver. 7.97 and prior, Air Conditioning System AE-200E Ver. 7.97 and prior, Air Conditioning System AE-50J Ver. 7.97 and prior, Air Conditioning System AE-50A Ver. 7.97 and prior, Air Conditioning System AE-50E Ver. 7.97 and prior, Air Conditioning System EW-50J Ver. 7.97 and prior, Air Conditioning System EW-50A Ver. 7.97 and prior, Air Conditioning System EW-50E Ver. 7.97 and prior, Air Conditioning System TE-200A Ver. 7.97 and prior, Air Conditioning System TE-50A Ver. 7.97 and prior and Air Conditioning System TW-50A Ver. 7.97 and prior allows a remote unauthenticated attacker to cause a disclosure of encrypted message of the air conditioning systems by sniffing encrypted communications.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

VendorProductVersions
n/aAir Conditioning System G-150AD; Air Conditioning System AG-150A-A; Air Conditioning System AG-150A-J; Air Conditioning System GB-50AD; Air Conditioning System GB-50ADA-A; Air Conditioning System GB-5Air Conditioning System G-150AD Ver. 3.21 and prior; Air Conditioning System AG-150A-A Ver. 3.21 and prior; Air Conditioning System AG-150A-J Ver. 3.21 and prior; Air Conditioning System GB-50AD Ver. 3.21 and prior; Air Conditioning System GB-50ADA-A Ver. 3.21 and prior; Air Conditioning System GB-50ADA-J Ver. 3.21 and prior; Air Conditioning System EB-50GU-A Ver. 7.10 and prior; Air Conditioning System EB-50GU-J Ver. 7.10 and prior; Air Conditioning System AE-200J Ver. 7.97 and prior; Air Conditioning System AE-200A Ver. 7.97 and prior; Air Conditioning System AE-200E Ver. 7.97 and prior; Air Conditioning System AE-50J Ver. 7.97 and prior; Air Conditioning System AE-50A Ver. 7.97 and prior; Air Conditioning System AE-50E Ver. 7.97 and prior; Air Conditioning System EW-50J Ver. 7.97 and prior; Air Conditioning System EW-50A Ver. 7.97 and prior; Air Conditioning System EW-50E Ver. 7.97 and prior; Air Conditioning System TE-200A Ver. 7.97 and prior; Air Conditioning System TE-50A Ver. 7.97 and prior; Air Conditioning System TW-50A Ver. 7.97 and prior

References

Timeline

Published
Jun 8, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-242976.7Improper buffer restrictions in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege viCVE-2022-242987.5All versions of package freeopcua/freeopcua are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory coCVE-2022-242998.8Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus softwarCVE-2022-24305.4The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Block' feature in versioCVE-2022-243009.8Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack metaCVE-2022-243016.5In Minetest before 5.4.0, players can add or subtract items from a different player's inventory.CVE-2022-243025.9In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized infCVE-2022-243039.1Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.CVE-2022-243059.8Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation.CVE-2022-243069.8Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled.CVE-2022-243079.8Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JCVE-2022-243085.5Automox Agent prior to version 37 on Windows and Linux and Version 36 on OSX could allow for a non privileged user to obtain sensitive infor