CVE-2025-14816

OVERVIEW CVE-2025-14816 is a cleartext storage vulnerability affecting multiple Mitsubishi Electric industrial control and human-machine interface (HMI) products, including GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64. The vulnerability exposes SQL Server credentials in plain text within the GUI of the Hyper Historian Splitter feature when SQL authentication is configured. Affected versions include Mitsubishi Electric and Iconics Digital Solutions product lines at version 10.97.3 and prior, with GENESIS affected at version 11.02 and prior. SEVERITY The vulnerability requires local access to exploit, representing a moderate attack complexity. A successful exploitation enables unauthorized access to SQL Server systems, potentially allowing adversaries to disclose, modify, or destroy sensitive operational data. The attack could also facilitate denial-of-service conditions against critical infrastructure systems that rely on these HMI and industrial automation platforms for operational visibility and control. EXPLOITATION STATUS CVE-2025-14816 is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation in the wild. The vulnerability remains inactive on security community hot lists, suggesting limited public attention and no readily available proof-of-concept code. However, organizations operating these Mitsubishi Electric products should prioritize remediation given the straightforward nature of the vulnerability and potential access to critical industrial control environments.