CVE-2025-14815: Mitsubishi SCADA Cleartext Vulnerability

CVE-2025-14815 Overview

A Cleartext Storage of Sensitive Information vulnerability (CWE-312) has been identified in multiple Mitsubishi Electric industrial control system products. This vulnerability allows a local attacker to disclose SQL Server credentials that are stored in plaintext within a local SQLite file when the local caching feature using SQLite is enabled and SQL authentication is used for the SQL Server authentication.

The impact of successful exploitation is severe: an unauthorized attacker could access the SQL Server and disclose, tamper with, or destroy data on the server, potentially causing a denial-of-service (DoS) condition on the system. Given the industrial control system (ICS) context of these products, the consequences could extend to operational disruption in critical infrastructure environments.

Critical Impact

Local attackers can extract SQL Server credentials stored in plaintext within SQLite cache files, enabling unauthorized database access, data tampering, data destruction, and denial-of-service conditions affecting industrial control systems.

Affected Products

• Mitsubishi Electric GENESIS64 versions 10.97.3 and prior
• Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior
• Mitsubishi Electric MobileHMI versions 10.97.3 and prior
• Mitsubishi Electric Hyper Historian versions 10.97.3 and prior
• Mitsubishi Electric AnalytiX versions 10.97.3 and prior
• Mitsubishi Electric GENESIS versions 11.02 and prior
• Mitsubishi Electric MC Works64 all versions
• Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior
• Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior
• Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.3 and prior
• Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior
• Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.3 and prior
• Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.02 and prior

Discovery Timeline

• April 8, 2026 - CVE CVE-2025-14815 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2025-14815

Vulnerability Analysis

This vulnerability stems from a fundamental secure coding violation: the storage of sensitive authentication credentials in cleartext format. When Mitsubishi Electric's industrial HMI and SCADA products are configured to use local caching via SQLite databases along with SQL Server authentication, the SQL Server credentials are written to the local SQLite cache file without any encryption or obfuscation.

The vulnerability requires local access to exploit, meaning an attacker must have some level of access to the system where the vulnerable software is installed. However, in industrial environments, workstations running HMI software may be accessible to multiple operators or contractors, expanding the potential attack surface.

The consequences of credential theft in this context are particularly concerning because:

1. SQL Server databases in ICS environments often contain critical operational data, historian records, and configuration parameters
2. Database tampering could affect process visualizations and operational decision-making
3. DoS attacks on the database could disrupt real-time monitoring capabilities

Root Cause

The root cause is improper handling of sensitive information (CWE-312: Cleartext Storage of Sensitive Information). The affected products fail to implement proper encryption for SQL Server credentials before storing them in the local SQLite cache. This represents a violation of secure credential storage best practices, which mandate that authentication secrets should never be stored in plaintext format on disk.

The vulnerability is specifically triggered when two conditions are met simultaneously:

1. The local caching feature using SQLite is enabled
2. SQL authentication (username/password) is used for SQL Server connectivity

Attack Vector

The attack requires local access to the target system. An attacker with local privileges can navigate to the SQLite database file location and directly read the cleartext credentials using any SQLite database viewer or standard database query tools.

The attack flow involves:

1. Gaining local access to a workstation running the vulnerable Mitsubishi Electric software
2. Locating the SQLite cache database file on the local filesystem
3. Opening the database and querying tables containing credential data
4. Using the extracted SQL Server credentials to connect to the database server
5. Performing unauthorized operations including data exfiltration, modification, or deletion

Since no code examples are verified for this vulnerability, organizations should refer to the Mitsubishi Electric Security Advisory and CISA ICS Advisory ICSA-26-097-01 for specific technical details about the credential storage location and exploitation methods.

Detection Methods for CVE-2025-14815

Indicators of Compromise

• Unexpected access to SQLite database files within Mitsubishi Electric software installation directories
• Suspicious local user activity patterns involving database file reads
• Unusual SQL Server login attempts from workstations running HMI software
• Failed or successful SQL Server authentication events with credentials associated with the vulnerable applications
• File access audit logs showing reads of SQLite cache files by non-application processes

Detection Strategies

• Implement file integrity monitoring on SQLite cache files used by the affected Mitsubishi Electric products
• Enable and monitor Windows Security Event logs for file access events (Event ID 4663) on sensitive application directories
• Configure SQL Server auditing to detect unusual login patterns or authentication from unexpected sources
• Deploy endpoint detection solutions to identify SQLite database access by unauthorized processes
• Monitor for the use of SQLite command-line tools or database viewers on ICS workstations

Monitoring Recommendations

• Establish baseline file access patterns for the affected application directories and alert on deviations
• Configure SQL Server login auditing to capture both successful and failed authentication attempts
• Implement network segmentation monitoring to detect lateral movement from HMI workstations to database servers
• Deploy SentinelOne Singularity for real-time endpoint monitoring and behavioral detection of credential access attempts

How to Mitigate CVE-2025-14815

Immediate Actions Required

• Review all affected Mitsubishi Electric product deployments to identify systems using SQLite caching with SQL Server authentication
• Consider temporarily disabling the local SQLite caching feature if operationally feasible
• Switch to Windows Authentication for SQL Server connections where possible, as this avoids storing credentials in the application
• Restrict local access to workstations running affected software to only essential personnel
• Rotate SQL Server credentials that may have been exposed through this vulnerability

Patch Information

Organizations should consult the official Mitsubishi Electric Security Advisory for specific patch information and remediation guidance. Additionally, review the CISA ICS Advisory ICSA-26-097-01 and JVN Vulnerability Report for coordinated vulnerability disclosure details and vendor recommendations.

Workarounds

• Disable the local SQLite caching feature to prevent credential storage in plaintext
• Migrate SQL Server authentication from SQL authentication to Windows Integrated Authentication
• Implement strict file system permissions on SQLite database directories to limit access to only the application service account
• Deploy application allowlisting to prevent unauthorized tools from accessing the SQLite database files
• Apply the principle of least privilege for SQL Server accounts used by the affected applications to limit impact if credentials are compromised

# Example: Restrict file permissions on SQLite cache directory (Windows)
# Run in elevated PowerShell
icacls "C:\ProgramData\ICONICS\SQLiteCache" /inheritance:r
icacls "C:\ProgramData\ICONICS\SQLiteCache" /grant:r "NT SERVICE\IconicsService:(OI)(CI)F"
icacls "C:\ProgramData\ICONICS\SQLiteCache" /grant:r "BUILTIN\Administrators:(OI)(CI)F"