CVE Intelligence
Analysis AI-assisted

CVE-2025-14816: Mitsubishi Electric GENESIS64 and ICONICS products: cleartext storage of SQL Server credentials

CVE-2025-14816 is a cleartext storage weakness (CWE-317) in the GUI of several Mitsubishi Electric and ICONICS industrial software products. The record states that SQL Server credentials are shown in plain text in the Hyper Historian Splitter feature when SQL authentication is used, and the CNA rates it 9.3 under CVSS 4.0. No fixed versions are listed in the record, so administrators should consult the vendor advisory and limit local access.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-14816 is a cleartext storage weakness (CWE-317) in the GUI of several Mitsubishi Electric and ICONICS industrial software products. According to the record, SQL Server credentials are displayed in plain text in the Hyper Historian Splitter feature when SQL authentication is used.

Impact

  • A local attacker may disclose SQL Server credentials shown in the GUI.
  • The record states that an attacker could then access the SQL Server and disclose, tamper with or destroy data, and potentially cause a denial-of-service condition.
  • The CNA rates the issue 9.3 under CVSS 4.0, and the vector string lists a local attack vector with low privileges required.

Affected products and versions

  • Mitsubishi Electric GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian and AnalytiX: versions 10.97.3 and prior.
  • Mitsubishi Electric GENESIS: versions 11.02 and prior.
  • Mitsubishi Electric MC Works64: all versions, as stated in the record.
  • The same products under the Mitsubishi Electric Iconics Digital Solutions naming, with the same version ranges.
  • The record lists no fixed versions. Consult the vendor advisory for remediation details.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation is reported in the sources consulted. The EPSS probability in the record is 0.00101 with a percentile of 0.00863.

Remediation and mitigation

  • Inventory all installations of the listed products and their versions, including MC Works64 which the record lists as all versions.
  • Check the vendor advisory and the CISA ICS advisory for update guidance.
  • Until an update is applied, restrict local access to engineering and operator workstations and limit who can open the Hyper Historian Splitter GUI.
  • Review whether SQL authentication is required in your configuration and prefer approaches that reduce credential exposure.
  • Rotate SQL Server credentials that may have been displayed and restrict database account privileges to the minimum needed.
  • Apply general ICS network segmentation practices to HMI and historian systems.

Detection guidance

  • Review logs for unusual local access to HMI and historian workstations and to SQL Server accounts used by these products.
  • Monitor SQL Server authentication events for unexpected logins, especially after any suspected credential exposure.
  • Audit who has access to the Hyper Historian Splitter screens as part of routine access reviews.

Limitations of the available information

  • The record does not provide fixed versions, patch availability details or the full text of the vendor and CISA advisories.
  • The CWE name is not provided in the record.
  • The JVN reference is listed, but its content was not included in the record.
  • Whether the rated impact applies to a specific deployment depends on configuration details that are unknown.

Frequently asked questions

What is the core weakness in CVE-2025-14816?

The record describes cleartext storage of sensitive information in the GUI. SQL Server credentials are shown in plain text in the Hyper Historian Splitter feature when SQL authentication is used.

Is there a fixed version listed for this CVE?

No. The record does not list fixed versions, so consult the vendor advisory from Mitsubishi Electric for remediation details.

Is this CVE known to be actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.