Critical 9.3Published Apr 8, 2026

CVE-2025-14816Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64

Updated under an hour ago (Oct 27, 2026, 3:50 AM ET)

Does this affect you?

It affects Mitsubishi Electric Corporation GENESIS64 and 12 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Mitsubishi Electric Corporation GENESIS64

Exploited in the last 30 days

Cleartext Storage of Sensitive Information in GUI vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric AnalytiX versions 10.97.3 and prior, Mitsubishi Electric GENESIS versions 11.02 and prior, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.3 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.02 and prior allows a local attacker to disclose the SQL Server credentials displayed in plain text in the GUI of the Hyper Historian Splitter feature by exploiting this vulnerability, when SQL authentication is used for the SQL Server authentication. As a result, the unauthorized attacker could access the SQL Server and disclose, tamper with, or destroy data on the server, potentially cause a denial-of-service (DoS) condition on the system.

CVSS: 9.3 CRITICAL (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness (CWE): CWE-317
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Mitsubishi
NVD analysis: Awaiting Analysis
Record last updated: Apr 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Mitsubishi Electric Corporation GENESIS64 mitsubishi_electric:genesis64 (from the name)	versions 10.97.3 and prior	CNA record
Mitsubishi Electric Iconics Digital Solutions GENESIS64 mitsubishi_electric_iconics_digital_solutions:genesis64 (from the name)	versions 10.97.3 and prior	CNA record
Mitsubishi Electric Corporation ICONICS Suite mitsubishi_electric:iconics_suite (from the name)	versions 10.97.3 and prior	CNA record
Mitsubishi Electric Iconics Digital Solutions ICONICS Suite mitsubishi_electric_iconics_digital_solutions:iconics_suite (from the name)	versions 10.97.3 and prior	CNA record
Mitsubishi Electric Corporation MobileHMI mitsubishi_electric:mobilehmi (from the name)	versions 10.97.3 and prior	CNA record
Mitsubishi Electric Iconics Digital Solutions MobileHMI mitsubishi_electric_iconics_digital_solutions:mobilehmi (from the name)	versions 10.97.3 and prior	CNA record
Mitsubishi Electric Corporation Hyper Historian mitsubishi_electric:hyper_historian (from the name)	versions 10.97.3 and prior	CNA record
Mitsubishi Electric Iconics Digital Solutions Hyper Historian mitsubishi_electric_iconics_digital_solutions:hyper_historian (from the name)	versions 10.97.3 and prior	CNA record
Mitsubishi Electric Corporation AnalytiX mitsubishi_electric:analytix (from the name)	versions 10.97.3 and prior	CNA record
Mitsubishi Electric Iconics Digital Solutions AnalytiX mitsubishi_electric_iconics_digital_solutions:analytix (from the name)	versions 10.97.3 and prior	CNA record
1–10 of 13

References

References

https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-023_en.pdf	vendor-advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-26-097-01	government-resource
https://jvn.jp/vu/JVNVU90646130/	government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.