Today CISA’s NCCIC-ICS published an update for an advisory for products from Mitsubishi.
Mitsubishi Update
This update provides additional information on the Air Conditioning Systems advisory that was originally published on June 26th, 2025, and most recently updated on August 21st, 2025. The new information includes changing affected products and mitigations.
NOTE: Mitsubishi reported that they have “no plans to release a fixed version, so please take the following Mitigations”. Those ‘mitigations’ include an almost obligatory: “Restrict the access to your air conditioning system from untrusted networks and hosts.” Some of the affected products in this advisory come with an ‘Access Restriction Setting’ that helps to accomplish that task. Since this is an operator setting fix, instead of a software fix, Mitsubishi claims this as a mitigation measure rather than a ‘Countermeasure for Customers’ or a fix. This is the new mitigation measure that is claimed in the CISA advisory.