Mitsubishi Electric GENESIS64 vulnerabilities

A cleartext storage of sensitive information vulnerability in the GUI of Mitsubishi Electric products (GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, MC Works64) allows a local attacker to disclose SQL Server credentials displayed in plain text in the Hyper Historian Splitter feature.

A vulnerability in Mitsubishi Electric software (GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, MC Works64) allows a local attacker to read SQL Server credentials stored in plaintext in a local SQLite file. This occurs when local caching using SQLite is enabled and SQL authentication is used.

An OS command injection vulnerability in the software keyboard (keypad) function of Mitsubishi Electric GENESIS64, ICONICS Suite, MobileHMI, and MC Works64 allows a local attacker to execute arbitrary executable files (EXE) by tampering with the configuration file when a legitimate user uses the keypad function. This could lead to disclosure, tampering, deletion, or destruction of information on the PC, or cause a denial-of-service (DoS) condition.