CVE-2025-14816: Mitsubishi SCADA Information Disclosure

CVE-2025-14816 Overview

CVE-2025-14816 is a Cleartext Storage of Sensitive Information in GUI vulnerability affecting multiple Mitsubishi Electric industrial control system (ICS) products, including GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64. The vulnerability exists in the Hyper Historian Splitter feature, which displays SQL Server credentials in plain text within the graphical user interface when SQL authentication is configured. A local attacker with low privileges can exploit this vulnerability to obtain database credentials, potentially leading to unauthorized access to the SQL Server where they could disclose, tamper with, or destroy critical data, as well as cause a denial-of-service (DoS) condition on affected systems.

Critical Impact

Local attackers can harvest SQL Server credentials displayed in plain text, enabling unauthorized database access that could result in data theft, tampering, destruction, or denial-of-service conditions on critical industrial control systems.

Affected Products

• Mitsubishi Electric GENESIS64 versions 10.97.3 and prior
• Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior
• Mitsubishi Electric MobileHMI versions 10.97.3 and prior
• Mitsubishi Electric Hyper Historian versions 10.97.3 and prior
• Mitsubishi Electric AnalytiX versions 10.97.3 and prior
• Mitsubishi Electric GENESIS versions 11.02 and prior
• Mitsubishi Electric MC Works64 all versions
• Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior
• Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior
• Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.3 and prior
• Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior
• Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.3 and prior
• Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.02 and prior

Discovery Timeline

• 2026-04-08 - CVE CVE-2025-14816 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2025-14816

Vulnerability Analysis

This vulnerability is classified under CWE-317 (Cleartext Storage of Sensitive Information in GUI), which describes a security weakness where sensitive data such as passwords or credentials are stored and displayed in an unprotected format within the user interface. In the context of CVE-2025-14816, the Hyper Historian Splitter feature within affected Mitsubishi Electric ICS products fails to properly mask or encrypt SQL Server authentication credentials when SQL authentication mode is enabled.

The vulnerability requires local access to the affected system, meaning an attacker must already have some level of access to the machine running the vulnerable software. However, only low-level privileges are required to exploit this issue, making it accessible to a wide range of potential attackers including malicious insiders, compromised user accounts, or attackers who have gained initial foothold through other means.

The impact is severe because the exposed credentials provide direct access to the SQL Server backend, which typically stores critical operational data for industrial control systems. Successful exploitation could allow attackers to exfiltrate sensitive operational data, modify configuration parameters or historical data records, delete critical database contents, or disrupt database availability causing operational impact to connected ICS systems.

Root Cause

The root cause of this vulnerability lies in improper credential handling within the Hyper Historian Splitter GUI component. When SQL Server authentication is configured (as opposed to Windows authentication), the application stores and renders the database credentials without implementing proper security controls such as masking, encryption, or access restrictions on the credential display fields. This violates secure development practices that mandate sensitive information should never be stored or displayed in cleartext, particularly in user-facing interfaces.

Attack Vector

The attack vector for CVE-2025-14816 is local, requiring the attacker to have direct access to a system running one of the affected Mitsubishi Electric products. The attack proceeds as follows:

1. The attacker gains local access to a workstation or server running affected Mitsubishi Electric software (GENESIS64, ICONICS Suite, Hyper Historian, etc.)
2. The attacker navigates to the Hyper Historian Splitter feature within the application's GUI
3. When SQL Server authentication is configured, the SQL Server username and password are displayed in plain text within the interface
4. The attacker captures these credentials through visual observation, screenshot, or by inspecting GUI element properties
5. Using the harvested credentials, the attacker connects directly to the SQL Server to perform unauthorized actions

The vulnerability is particularly dangerous in ICS/SCADA environments where operational data integrity is critical for maintaining safe and reliable industrial processes. The ability to modify or destroy historical data could mask operational anomalies or sabotage compliance reporting.

Detection Methods for CVE-2025-14816

Indicators of Compromise

• Unusual access to the Hyper Historian Splitter configuration interface by non-administrative users
• Unexpected SQL Server login attempts using service account credentials from unauthorized workstations
• Database audit logs showing access from IP addresses or user contexts that don't match normal operational patterns
• Screenshots or screen capture software activity on systems running affected Mitsubishi Electric products

Detection Strategies

• Enable SQL Server login auditing to track all authentication attempts and identify suspicious access patterns
• Monitor file system and registry access to configuration files that may contain credential information
• Implement endpoint detection to identify screen capture or credential harvesting tools on systems running affected ICS software
• Review Windows Security Event logs for unusual process access to the affected application executables

Monitoring Recommendations

• Configure alerts for SQL Server logins from unexpected source systems or outside normal operational hours
• Implement user behavior analytics to detect anomalous access to ICS management interfaces
• Monitor network traffic for SQL Server connections originating from systems that should not have direct database access
• Establish baseline access patterns for the Hyper Historian Splitter feature and alert on deviations

How to Mitigate CVE-2025-14816

Immediate Actions Required

• Review and restrict local access to systems running affected Mitsubishi Electric ICS products to only authorized personnel
• Switch from SQL Server authentication to Windows authentication where possible, as this vulnerability only affects SQL authentication mode
• Implement the principle of least privilege for all accounts with access to affected systems
• Rotate SQL Server credentials that may have been exposed through vulnerable installations
• Isolate affected ICS systems on network segments with restricted access

Patch Information

Mitsubishi Electric has released a security advisory addressing this vulnerability. Organizations should consult the Mitsubishi Electric Vulnerability Advisory for specific patch availability and update instructions. Additional guidance is available from CISA ICS Advisory ICSA-26-097-01 and the JVN Security Vulnerability Report.

Workarounds

• Use Windows authentication instead of SQL Server authentication to avoid credential exposure in the GUI
• Implement strict physical and logical access controls to systems hosting affected Mitsubishi Electric products
• Configure network segmentation to prevent direct SQL Server access from non-essential systems
• Deploy endpoint protection solutions to monitor and prevent credential harvesting activities on ICS workstations

# Example: Restrict SQL Server access to specific IP addresses
# Execute in SQL Server Management Studio or sqlcmd
# Create a login trigger to restrict access by IP address

# Windows Firewall rule to restrict SQL Server access
netsh advfirewall firewall add rule name="Restrict SQL Server" dir=in action=allow protocol=tcp localport=1433 remoteip=10.0.0.0/24