CVE Intelligence
Analysis AI-assisted

CVE-2025-14815: Mitsubishi Electric GENESIS64 and ICONICS suite: cleartext storage of SQL Server credentials

CVE-2025-14815 is a cleartext storage weakness (CWE-312) in several Mitsubishi Electric and ICONICS industrial software products, where SQL Server credentials are kept in plaintext in a local SQLite file when the local caching feature is enabled and SQL authentication is used. The CNA assigned a CVSS 4.0 base score of 9.3 (critical), and the attack requires local access. The record does not list fixed versions, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-14815 describes cleartext storage of sensitive information (CWE-312) in multiple Mitsubishi Electric and ICONICS products used in industrial and monitoring software environments. According to the description, SQL Server credentials are stored in plaintext in a local SQLite file when the local caching feature is enabled and SQL authentication is used.

Impact

The description states that a local attacker could disclose the stored SQL Server credentials. The same description says that an unauthorized party could then access the SQL Server and disclose, tamper with, or destroy data on the server, and could potentially cause a denial-of-service condition.

  • The CNA scored the issue at CVSS 4.0 base score 9.3, with high impact on confidentiality, integrity and availability for the vulnerable system and subsequent systems.
  • The vector includes local attack vector, low attack complexity, no attack requirements, low privileges and no user interaction.

Affected products and versions

The description lists the following products and versions:

  • Mitsubishi Electric GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian and AnalytiX: version 10.97.3 and prior.
  • Mitsubishi Electric GENESIS: version 11.02 and prior.
  • Mitsubishi Electric MC Works64: all versions.
  • The Iconics Digital Solutions variants of the products above, with the same version ranges as listed in the description.

The structured affected-products field in the record is empty, so the version ranges above come from the description text only. Confirm applicability against the vendor advisory.

Exploitation status

The record shows that this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00101, which is a low modeled likelihood of exploitation.

Remediation and mitigation

The record does not include fixed versions or patch identifiers. The absence of fixed versions in the record does not mean that no fix exists. Defenders should review the vendor advisory and the CISA advisory for remediation instructions.

  • Inventory all systems running the listed products and versions, including engineering and historian workstations.
  • Check whether the local caching feature using SQLite is enabled and whether SQL authentication is used to reach SQL Server. These conditions are described as required.
  • Restrict local access to affected hosts, following the principle of least privilege for operator and service accounts.
  • Where feasible, plan migration to integrated or otherwise more protected authentication methods, and rotate SQL Server credentials that may have been stored in the local file.
  • Protect the SQLite file with restrictive file system permissions and include it in host hardening baselines.

Detection guidance

  • Monitor for unexpected access to local cache files used by the affected products, and for unusual logons to SQL Server from hosts that do not normally connect to it.
  • Review SQL Server audit logs for authentication from unexpected accounts or sources, and for unexpected changes to or deletion of data.
  • Track service availability for the affected applications, since the description mentions a possible denial-of-service outcome.

Limitations of the available information

  • The structured affected-products, fixes and patch fields are empty in the record.
  • The record does not describe the exact file location, file format details or technical conditions beyond those in the description, and this analysis does not include them.
  • The EPSS data carries a date of 2026-10-13, which is later than the publication date in the record. Treat the EPSS figures with caution until refreshed.
  • Vendor advisory content was not included in the record, so the remediation status for each product must be verified with the vendor.

Frequently asked questions

What is the core weakness in CVE-2025-14815?

The description states that SQL Server credentials are stored in plaintext in a local SQLite file when local caching is enabled and SQL authentication is used. This is classified as CWE-312, cleartext storage of sensitive information.

Is CVE-2025-14815 known to be actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.

Does the record provide fixed versions?

No. The fixes field is empty. The absence of fixed versions in the record does not mean no fix exists, so consult the vendor advisory.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.