Loading story…
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions disclosed a high-severity vulnerability affecting multiple GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works 64 products. The flaw, tracked as CWE-312 for cleartext storage of sensitive information, occurs when local caching with SQLite is enabled and SQL authentication is used, causing SQL Server credentials to be stored in plaintext in local cache files. CISA said the issue could allow information disclosure and could also enable tampering or denial-of-service conditions; the advisory assigned the vulnerability a CVSS v3.1 score of 8.8.
Mitsubishi Electric released fixes in version 10.98 or later for several affected product lines and version 11.03 or later for GENESIS, while no fix is planned for MC Works 64. CISA and the vendor urged operators to disable local cache where possible, delete cached database files, use Windows authentication instead of SQL authentication, and reduce exposure by restricting administrative and remote access, segmenting affected systems on internal networks, and limiting physical and network access to industrial control environments.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CISA published advisory ICSA-26-097-01 describing the cleartext storage issue as a CWE-312 vulnerability with a CVSS v3.1 score of 8.8. The advisory recommended mitigations including disabling local cache, deleting cached database files, using Windows authentication, and restricting remote and network exposure.
Mitsubishi Electric released fixes in version 10.98 or later for several affected products and version 11.03 or later for GENESIS. The advisory states that no fix is planned for MC Works 64.
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions disclosed a high-severity vulnerability affecting multiple GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works 64 products. The flaw occurs when local caching with SQLite is enabled and SQL authentication is used, causing SQL Server credentials to be stored in plaintext in local cache files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions disclosed multiple vulnerabilities affecting **ICONICS Suite**, **GENESIS64**, **GENESIS32**, **MC Works64**, and related products used in industrial and manufacturing environments. CISA said the flaws include **deserialization-based remote code execution**, **path traversal**, inclusion of functionality from an untrusted control sphere, and an **out-of-bounds read** that could lead to information disclosure or denial of service. The most severe issue carries a **CVSS v3.1 score of 9.8**, and affected versions include GENESIS64 and ICONICS Suite `10.97` through `10.97.1`, **MC Works64** up to `4.04E`, and **GENESIS32** up to `9.7`. A separate updated advisory also detailed an **information tampering** flaw caused by execution with unnecessary privileges across additional ICONICS-related products, including **MobileHMI**, **Hyper Historian**, **AnalytiX**, **IoTWorX**, **GENESIS**, and **BizViz**. CISA said a low-privileged local attacker could create a symbolic link and abuse service file writes to overwrite arbitrary files, potentially destroying files and causing denial of service, a weakness tracked under **CWE-250** and rated **CVSS 6.5**. Vendor fixes are available for several current product lines, including version `10.98` or later for GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, and AnalytiX, version `10.96` or later for IoTWorX, and version `11.01` or later for GENESIS, while no fixes are planned for some legacy products such as **MC Works64**, **GENESIS32**, and **BizViz**; operators are urged to isolate affected systems, restrict remote and physical access, and use firewalls or VPNs.
Jun 29, 2026
CISA updated advisories for **Mitsubishi Electric Iconics Digital Solutions** and related Mitsubishi products after disclosure of a high-severity malicious code execution vulnerability in the **Phone agent** used by the multi-agent notification feature. The flaw is an **uncontrolled search path element** issue tracked as **`CWE-427`** and affects **GENESIS64**, **ICONICS Suite**, **MC Works64**, **GENESIS32**, and **Hyper Historian**. According to the advisory, all versions of **MC Works64** and **GENESIS32** are impacted, while **GENESIS64**, **ICONICS Suite**, and **Hyper Historian** are affected through version **10.97.3**; CISA also referenced related updates covering Mitsubishi HMI/SCADA deployments. Exposure depends on whether the multi-agent notification feature and **Phone agent** are installed and, in some cases, whether a **Dialogic telephony board driver** is present. Mitsubishi said a fix is available in version **10.98** or later for some environments that do not require the Phone agent, but no fix is planned for **MC Works64**, **GENESIS32**, or certain Phone agent use cases. CISA and Mitsubishi recommended removing the multi-agent notification feature if it is not needed, avoiding Phone agent installation during custom setup, installing the Dialogic driver where applicable, and tightening network segmentation, remote access, email handling, and physical access controls. The vulnerability carries a **CVSS v3.1 score of 7.8**.
Jun 29, 2026
CISA issued an updated industrial control systems advisory for Mitsubishi Electric **MELSEC iQ-F, iQ-R, Q, and L series** products affected by a plaintext password storage flaw tracked as **`CVE-2023-0457`** and classified as **`CWE-256`**. The vulnerability allows an unauthenticated remote attacker to recover plaintext credentials from project files and potentially use them to authenticate to associated **FTP** or web servers. CISA assigned the issue a **CVSS v3 score of 7.5** and said the weakness affects multiple CPU and Ethernet modules across the listed MELSEC product families. Mitsubishi Electric and CISA advised operators to reduce exposure by encrypting project files and communications, restricting network access with firewalls or VPNs, preferring LAN-only deployments where feasible, limiting physical access, and enabling IP filtering on supported iQ-F and iQ-R devices. The updated notice builds on an earlier CISA advisory covering the MELSEC iQ-F series, while CISA said it is not aware of public exploits specifically targeting this vulnerability.
Jun 29, 2026