Mitsubishi Electric disclosed a critical authentication bypass vulnerability affecting 27 air conditioning system models. The vulnerability, CVE-2025-3699, allows remote attackers to gain unauthorized control over building HVAC systems. Attackers can control air conditioning systems, access sensitive information, and tamper with firmware. The attack requires no user interaction and can be executed remotely, making it particularly dangerous. The vulnerability affects a wide range of Mitsubishi Electric air conditioning systems, posing significant risks to commercial buildings and industrial facilities.