CVE-2025-14815: Mitsubishi Electric GENESIS64 and ICONICS Suite cleartext storage of credentials

CVE-2025-14815 · Severity: info · CVSS 9.3 · Published 2026-04-08

Multiple Mitsubishi Electric industrial automation and monitoring products are affected by a security flaw where database credentials are stored in plain text on the local system. These products are used to manage and visualize industrial control systems; if an attacker gains local access to a machine running this software, they could steal the credentials to access the underlying SQL Server. This could allow them to view sensitive operational data, modify system configurations, or disrupt industrial processes.

Technologies: Mitsubishi Electric AnalytiX, Mitsubishi Electric GENESIS64, Mitsubishi Electric Hyper Historian, Mitsubishi Electric ICONICS Suite, Mitsubishi Electric MC Works64, Mitsubishi Electric MobileHMI. Vendors: Mitsubishi Electric.

Quick answers

Is CVE-2025-14815 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-14815 being exploited in the wild.
How severe is CVE-2025-14815?
Informational severity, with a CVSS score of 9.3, published 8 April 2026.
Which products and versions are affected?
Mitsubishi Electric AnalytiX 10.97.3 and prior; Mitsubishi Electric GENESIS64 10.97.3 and prior; Mitsubishi Electric Hyper Historian 10.97.3 and prior; Mitsubishi Electric ICONICS Suite 10.97.3 and prior; and 2 more.
Is there a fix for CVE-2025-14815?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-14815 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2025-14815?
Check whether you run Mitsubishi Electric AnalytiX, Mitsubishi Electric GENESIS64, Mitsubishi Electric Hyper Historian or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cleartext Storage of Sensitive Information vulnerability (CWE-312) exists in several Mitsubishi Electric products when the local caching feature using SQLite is enabled and SQL authentication is used for the SQL Server. A local attacker with low privileges can access the local SQLite cache files (typically located in ProgramData) to retrieve plaintext SQL Server credentials. Successful exploitation allows the attacker to authenticate to the SQL Server with the stolen credentials to disclose, modify, or delete data, or cause a denial-of-service. Patches are available for most products (v10.98 or v11.03), though MC Works64 has no planned fix and requires manual mitigation by disabling the local cache and deleting existing cache files.

Affected products

  • Mitsubishi Electric GENESIS64 10.97.3 and prior
  • Mitsubishi Electric ICONICS Suite 10.97.3 and prior
  • Mitsubishi Electric MobileHMI 10.97.3 and prior
  • Mitsubishi Electric Hyper Historian 10.97.3 and prior
  • Mitsubishi Electric AnalytiX 10.97.3 and prior
  • Mitsubishi Electric GENESIS 11.02 and prior
  • Mitsubishi Electric MC Works64 all versions

Timeline

  • 2026-04-07: advisory: CISA and JVN published advisories.
  • 2026-04-08: disclosed: CVE-2025-14815 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.