CVE-2025-14816
This vulnerability occurs when sensitive SQL Server credentials are stored in plain text within the Graphical User Interface (GUI) of certain Mitsubishi Electric software components. This happens specifically when SQL authentication is being used to connect to the SQL Server.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of Mitsubishi Electric software, including GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, MC Works64, and Iconics Digital Solutions versions 10.97.3 and prior (or version 11.02 and prior for GENESIS), specifically when using SQL authentication for SQL Server.
Real-world impact
A local attacker could view these credentials in plain text, allowing them to gain unauthorized access to the SQL Server. Once inside, they could steal, modify, or delete data, or potentially crash the system.
Why this severity
The critical severity score reflects the high impact on data integrity, confidentiality, and availability, as an attacker can gain full control over the database contents.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Apr 8, 2026 · Apr 8, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.