CVE-2025-14816Patch

CVE-2025-14816: Mitsubishi Electric Hyper Historian Splitter stores SQL creds in plaintext in GUI. Local low-priv user can read them. No patch. Switch to Windows Auth or get owned. #infosec #OTsecurity #CVE #devsecops #cybersecurity #python #hackers More info in reply

CVE-2025-14816 Cleartext Storage of Sensitive Information in GUI vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite version… https://www.cve.org/CVERecord?id=CVE-2025-14816

⚠️ **Vulnerability Alert:** CISA ICS Advisory: Mitsubishi Electric GENESIS64 and ICONICS Suite products (multiple ICS advisories/updates) 📅 **Timeline:** Disclosure: 2026-04-07, Patch: Multiple (see references) 🆔 **CVE-2025-14815** | 📊 CVSS: 8.8 (HIGH 🟠) | 📈 EPSS: Not Available 🆔 **CVE-2025-14816** | 📊 CVSS: 8.8 (HIGH 🟠) | 📈 EPSS: Not Available 🆔 **CVE-2025-7376** | 📊 CVSS: 5.9 (MEDIUM 🟡) | 📈 EPSS: 1.456% 🆔 **CVE-2025-0921** | 📊 CVSS: 6.5 (MEDIUM 🟡) | 📈 EPSS: 20.714% 🆔 **CVE-2024-8299** | 📊 CVSS: 7.8 (HIGH 🟠) | 📈 EPSS: 6.927% 🆔 **CVE-2024-8300** | 📊 CVSS: 7.0 (HIGH 🟠) | 📈 EPSS: 10.572% 🆔 **CVE-2024-9852** | 📊 CVSS: 7.8 (HIGH 🟠) | 📈 EPSS: 6.927% 🆔 **CVE-2023-2650** | 📊 CVSS: 3.7 (LOW 🟢) | 📈 EPSS: 99.698% 🆔 **CVE-2023-4807** | 📊 CVSS: 5.9 (MEDIUM 🟡) | 📈 EPSS: 74.338% 🆔 **CVE-2024-1182** | 📊 CVSS: 7.0 (HIGH 🟠) | 📈 EPSS: 18.210% 🆔 **CVE-2024-1573** | 📊 CVSS: 5.9 (MEDIUM 🟡) | 📈 EPSS: 47.466% 🆔 **CVE-2024-1574** | 📊 CVSS: 6.7 (MEDIUM 🟡) | 📈 EPSS: 34.105% 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** GENESIS64/ICONICS Suite/MobileHMI/Hyper Historian/AnalytiX <=10.97.3, MC Works64 — all versions, GENESIS <=11.03 (varies by advisory), IoTWorX 10.95, GENESIS32/BizViz — various versions 🔧 **Fixed Versions:** GENESIS64/ICONICS Suite/MobileHMI/Hyper Historian/AnalytiX: 10.98+, GENESIS: 11.01 / 11.03+, IoTWorX: 10.96+, No fix for MC Works64/GENESIS32/BizViz — vendor mitigations 🫨 **Attack Vectors:** - Local attacker / local access required - Cleartext storage of SQL credentials in local SQLite cache and plaintext display in GUI - Windows .LNK/symbolic-link exploitation enabling arbitrary writes - DLL search-path/DLL planting (uncontrolled search path) - OpenSSL parsing via BACnet Secure Connect (remote malformed cert/MAC) - Authentication bypass via AD + automatic logon conditions - Execution with unnecessary privileges / unsafe reflection 📝 **Summary:** Multiple local (and some remote) vulnerabilities across Mitsubishi/ICONICS ICS products expose plaintext SQL credentials, enable arbitrary file writes and DLL planting, and allow authentication bypass or unsafe code execution paths. Impacts include credential disclosure, tampering, denial-of-service, and, in some cases, elevated arbitrary code execution — patch immediately where available and apply mitigations for unpatchable products. 📈 **Impact Scope:** Affects multiple Mitsubishi Electric / ICONICS products used in critical manufacturing ICS: credential disclosure, information disclosure, arbitrary file tampering/deletion, DoS, and potential code execution with elevated privileges. 🛡️ **Recommended Actions:** - Apply vendor-supplied patches immediately; isolate ICS networks, restrict remote/admin logins and enforce least privilege. - Disable/delete local cache (C:\ProgramData\ICONICS\Cache\*.sdf and C:\ProgramData\ICONICS\11\Cache\*.sqlite3), prefer Windows auth for SQL Server, harden HHSplitter.exe, and follow vendor mitigations for unpatched products. 🪢 **Related Resources:** - https://www.youtube.com/watch?v=KsZ6tROaVOQ - https://en.wikipedia.org/wiki/2 🏷 **Tags:** #Cybersecurity #ICS #MitsubishiElectric

⚠️ **Vulnerability Alert:** Cleartext Storage and Display of SQL Server Credentials in Mitsubishi Electric GENESIS64 and ICONICS Suite (CVE-2025-14815, CVE-2025-14816) 🆔 **CVE-2025-14815** | 📊 CVSS: 8.8 (High 🟠) | 📈 EPSS: N/A% 🆔 **CVE-2025-14816** | 📊 CVSS: 8.8 (High 🟠) | 📈 EPSS: N/A% 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** GENESIS64/ICONICS Suite/MobileHMI/Hyper Historian/AnalytiX <= 10.97.3, MC Works 64 (all versions), GENESIS <= 11.02 🔧 **Fixed Versions:** 10.98+ (GENESIS64/ICONICS Suite/MobileHMI/Hyper Historian/AnalytiX), 11.03+ (GENESIS), No fix planned (MC Works 64) 🫨 **Attack Vectors:** - Local filesystem access to plaintext SQLite cache - Local viewing/access to Hyper Historian Splitter GUI - Requires SQL Server authentication to be enabled - Insider or local attacker with file/GUI access 📝 **Summary:** Two high-severity flaws expose SQL Server credentials in plaintext—one via local SQLite caching (CWE-312) and one via GUI display in Hyper Historian Splitter (CWE-317). An attacker with local or GUI access can steal those credentials to access, tamper with, or destroy database data and move laterally. 📈 **Impact Scope:** Plaintext SQL credentials enable unauthorized DB access leading to data disclosure, tampering, destruction, service disruption, and potential lateral movement. 🛡️ **Recommended Actions:** - Apply vendor fixes: upgrade to 10.98+ for GENESIS64/ICONICS Suite/MobileHMI/Hyper Historian/AnalytiX or 11.03+ for GENESIS - If patching isn't immediate, disable local SQLite caching and Hyper Historian Splitter or restrict access to them - Enforce least-privilege access to filesystem and GUIs; prefer integrated/Windows authentication over SQL auth - Rotate exposed SQL credentials and monitor for anomalous local and DB activity 🪢 **Related Resources:** - https://www.cisa.gov/news-events/ics-advisories/icsa-26-097-01 - https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2025-023.pdf 🏷 **Tags:** #Cybersecurity #ICS #MitsubishiElectric

⚠️ **Vulnerability Alert:** Plaintext storage of sensitive information in multiple Mitsubishi Electric products (CVE-2025-14815, CVE-2025-14816) 🆔 **CVE-2025-14815** 🆔 **CVE-2025-14816** 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** GENESIS64/ICONICS Suite/MobileHMI/Hyper Historian/AnalytiX ≤10.97.3, GENESIS ≤11.02, MC Works64: All versions 🔧 **Fixed Versions:** Patched/latest versions for GENESIS64/ICONICS/MobileHMI/Hyper Historian/AnalytiX/GENESIS, No fix for MC Works64 (vendor recommends replacement or mitigations) 🫨 **Attack Vectors:** - Local access to machines with enabled local SQLite cache allowing reading of plaintext SQL credentials - Access to Hyper Historian Splitter GUI/plaintext GUI storage to obtain SQL credentials - Use of obtained SQL Server credentials to access/modify databases leading to disclosure, tampering, or DoS 📝 **Summary:** Multiple Mitsubishi Electric products store SQL Server credentials in plaintext (local SQLite cache and Hyper Historian Splitter), allowing attackers who obtain those credentials to access or tamper with databases and disrupt services. MC Works64 currently has no vendor fix and requires replacement or mitigations. 📈 **Impact Scope:** Plaintext SQL credential exposure across affected GENESIS/ICONICS products may enable unauthorized DB access, data disclosure, tampering, and service disruption; MC Works64 has no available fix. 🛡️ **Recommended Actions:** - Apply vendor-provided updates/patches where available - Replace MC Works64 with GENESIS64 or apply vendor-provided mitigations/workarounds - Rotate SQL Server credentials if exposure is suspected - Audit for use of local SQLite cache and Hyper Historian Splitter and remediate plaintext credential storage - Harden access to systems storing credentials and monitor for unauthorized access 🪢 **Related Resources:** - https://jvn.jp/vu/JVNVU90646130/ 🏷 **Tags:** #Cybersecurity #MitsubishiElectric #ICS