CVE-2026-16437
HighCVSS 7.1Summary
A weak password recovery mechanism for forgotten passwords in Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators can read and write the management file, but it is protected by Windows.
Risk Assessment
An attacker may disclose, tamper with, destroy or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
Recommendation
Upgrade the products to versions containing the fix and restrict local administrative access to the systems to reduce the risk of management file tampering.
Other vulnerabilities in Mitsubishi Electric GENESIS/ICONICS Suite
Original NVD description (English source)
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS