description: Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to
attackers with access to the local area network (LAN) to disclose sensitive information stored by the affected product without requiring authentication.
problem types: CWE-284 Improper Access Control
affected:
{
defaultStatus: unaffected
product: SVMPC1
vendor: Daikin
versions:
lessThanOrEqual: 2.1.22, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: SVMPC2
vendor: Daikin
versions:
lessThanOrEqual: 1.2.3, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Daikin Holdings Singapore Pte Ltd. has released an update that will
automatically install if the SVM controller is enabled. No user
operation is required.