← All Advisories
Reported from OT-Advisories.com as of

Mitsubishi Electric Corporation GENESIS Weak Password Recovery Mechanism For Forgotten Password Rated 7.1 CVSS

Last refreshed2026-10-15

Status: UPDATED  |  Advisory ID: CVE-2026-16437

Key Details

CVECVE-2026-16437
CVSS Score / Version
7.1 (High) / CVSS v4.0
Updated2026-10-15
Affected products
see table below
Classified as
CWE-640 (Weak Password Recovery Mechanism for Forgotten Password)
Exploitation prediction (EPSS)
0.09% probability of exploitation in the next 30 days (1% percentile) -- FIRST.org's EPSS model.

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
Mitsubishi Electric CorporationGENESIS
Mitsubishi Electric Iconics Digital SolutionsGENESIS
Mitsubishi Electric CorporationGENESIS64
Mitsubishi Electric Iconics Digital SolutionsGENESIS64
Mitsubishi Electric CorporationICONICS Suite
Mitsubishi Electric Iconics Digital SolutionsICONICS Suite
Mitsubishi Electric CorporationHyper Historian
Mitsubishi Electric Iconics Digital SolutionsHyper Historian
Mitsubishi Electric CorporationAnalytiX
Mitsubishi Electric Iconics Digital SolutionsAnalytiX
Mitsubishi Electric CorporationMobileHMI
Mitsubishi Electric Iconics Digital SolutionsMobileHMI
Mitsubishi Electric CorporationIoTWorX
Mitsubishi Electric Iconics Digital SolutionsIoTWorX
Mitsubishi Electric CorporationMC Works64
Mitsubishi Electric CorporationGENESIS32
Mitsubishi Electric Iconics Digital SolutionsGENESIS32
Mitsubishi Electric CorporationBizViz
Mitsubishi Electric Iconics Digital SolutionsBizViz
SubsystemsGeneral OT
SectorsMultiple

What to Know

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition. (NVD)

What to Do

Monitor Mitsubishi Electric Corporation's and Mitsubishi Electric Iconics Digital Solutions's web pages for any future patch releases.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-16437
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-16437

About

OT-Advisories  ·  CVE  ·  NVD  ·  CVSS  ·  KEV  ·  EPSS  ·  CWE
Report compilation © 2026 OT-Advisories.com  ·  CC BY 4.0  ·  Source materials remain the property of their respective publishers as cited.