PT-2026-30802 · Mitsubishi · Analytix+6

Published 2026-04-07 · Updated 2026-05-02 · CVE-2025-14816

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric GENESIS64 versions prior to 10.97.3 Mitsubishi Electric ICONICS Suite versions prior to 10.97.3 Mitsubishi Electric MobileHMI versions prior to 10.97.3 Mitsubishi Electric Hyper Historian versions prior to 10.97.3 Mitsubishi Electric AnalytiX versions prior to 10.97.3 Mitsubishi Electric GENESIS versions prior to 11.02 Mitsubishi Electric MC Works64 (affected versions not specified) Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions prior to 10.97.3 Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions prior to 10.97.3 Mitsubishi Electric Iconics Digital Solutions MobileHMI versions prior to 10.97.3 Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions prior to 10.97.3 Mitsubishi Electric Iconics Digital Solutions AnalytiX versions prior to 10.97.3 Mitsubishi Electric Iconics Digital Solutions GENESIS versions prior to 11.02

Description Cleartext storage of sensitive information in the GUI allows a local attacker to disclose SQL Server credentials. This occurs within the Hyper Historian Splitter feature when SQL authentication is used for the SQL Server. An unauthorized attacker could use these credentials to access the SQL Server to disclose, tamper with, or destroy data, which may lead to a denial-of-service (DoS) condition on the system.

Recommendations Switch to Windows Authentication for SQL Server authentication to prevent the storage of credentials in plain text. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-317

Related Identifiers

CVE-2025-14816

Affected Products

Analytix

Genesis

Genesis64

Hyper Historian

Iconics Suite

Mc Works64

Mobilehmi

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14816 · Security Note
• https://mitsubishielectric.com/psirt/vulnerability/pdf/2025-023_en.pdf · Vendor Advisory
• https://twitter.com/syedaquib77/status/2041684073001721864 · Twitter Post
• https://twitter.com/HugoValters/status/2050685991195672793 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-26-097-01 · Note
• https://jvn.jp/vu/JVNVU90646130 · Note
• https://twitter.com/syedaquib77/status/2041374128926584867 · Twitter Post