Critical severity · published Apr 8, 2026
CVE-2025-14815
Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64
9.3
CVSS
0.1%
EPSS
No
On KEV
Description
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric AnalytiX versions 10.97.3 and prior, Mitsubishi Electric GENESIS versions 11.02 and prior, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.3 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.02 and prior allows a local attacker to disclose the SQL Server credentials stored in plaintext within the local SQLite file by exploiting this vulnerability, when the local caching feature using SQLite is enabled and SQL authentication is used for the SQL Server authentication. As a result, the unauthorized attacker could access the SQL Server and disclose, tamper with, or destroy data on the server, potentially cause a denial-of-service (DoS) condition on the system.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
AnalytiX · Mitsubishi Electric Iconics Digital Solutions
versions 10.97.3 and prior · source: vendor
GE
GENESIS · Mitsubishi Electric Iconics Digital Solutions
versions 11.02 and prior · source: vendor
GE
GENESIS64 · Mitsubishi Electric Corporation
versions 10.97.3 and prior · source: vendor
HH
Hyper Historian · Mitsubishi Electric Corporation
versions 10.97.3 and prior · source: vendor
IS
ICONICS Suite · Mitsubishi Electric Iconics Digital Solutions
versions 10.97.3 and prior · source: vendor
MW
MC Works64 · Mitsubishi Electric Corporation
all versions · source: vendor
MO
MobileHMI · Mitsubishi Electric Iconics Digital Solutions
versions 10.97.3 and prior · source: vendor
In the news
VulnerabilityHigh
Mitsubishi Electric GENESIS64 and ICONICS Suite products
View CSAF
Summary
Successful exploitation of these vulnerabilities could allow a local attacker to disclose SQL Server credentials used by the affected products and use them to disclose, tamper with, or destroy data, or to cause a denial-of-service (DoS) condition on the system.
The following versions of Mitsubishi Electric GENESIS64 and ICONICS Suite products are affected:
GENESIS64 <=10.97.3 (CVE-2025-14815, CVE-2025-14816)
ICONICS Suite <=10.97.3 (CVE-2025-14815, CVE-2025-14816)
MobileHMI <=10.97.3 (CVE-2025-14815, CVE-2025-14816)
Hyper Historian <=10.97.3 (CVE-2025-14815, CVE-2025-14816)
AnalytiX <=10.97.3 (CVE-2025-14815, CVE-2025-14816)
MC Works 64 vers:all/* (CVE-2025-14815, CVE-2025-14816)
GENESIS <=11.02 (CVE-2025-14815, CVE-2025-14816)
CVSS
Vendor
Equipment
Vulnerabilities
v3 8.8
Mitsubishi Electric
Mitsubishi Electric GENESIS64 and ICONICS Suite products
Cleartext Storage of Sensitive Information, Cleartext Storage of Sensitive Information in GUI
Background
Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Mitsubishi Electric Iconics Digital Solutions is headquartered in the United States. Mitsubishi Electric is headquartered in Japan.
Vulnerabilities
Expand All +
CVE-2025-14815
When the local caching feature using SQLite is enabled and SQL authentication is used for the ...
Apr 7, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14815
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14815
jvn.jp
https://jvn.jp/vu/JVNVU90646130/
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-26-097-01
www.mitsubishielectric.com
https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-023_en.pdf
More from AnalytiX
9.4
CVE-2026-16438
An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64
9.3
CVE-2025-14816
Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64
9.2
CVE-2026-16436
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
7.1
CVE-2026-16437
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz