Critical

Cleartext SQL Server credentials exposure in Mitsubishi Electric Hyper Historian Splitter GUI

IdentifiersCVE-2025-14816CWE-317· Cleartext Storage of Sensitive…

CVE-2025-14816 is a cleartext exposure of sensitive information vulnerability affecting Mitsubishi Electric GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, MC Works64, and corresponding Mitsubishi Electric Iconics Digital Solutions branded products in the listed affected versions. In the Hyper Historian Splitter feature, when SQL authentication is used for SQL Server authentication, the SQL Server credentials are displayed in plain text in the GUI. This exposes sensitive database authentication material to a local attacker with access to the interface. The issue is classified as CWE-317. By obtaining the exposed credentials, an attacker can authenticate to the backend SQL Server and abuse that access against the associated data and services.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a local attacker to disclose SQL Server credentials and then use those credentials to access the SQL Server. Depending on the privileges associated with the exposed account, this can enable unauthorized disclosure of data, modification or destruction of data stored on the server, and actions that could cause a denial-of-service condition affecting the system or dependent application functionality.

Mitigation

If you can’t patch tonight, do this now.

Where immediate patching is not possible, avoid using SQL authentication for the affected Hyper Historian Splitter workflow if operationally feasible, and prefer integrated or alternative authentication methods that do not require exposing reusable SQL credentials in the GUI. Restrict local access to affected systems and HMIs to only trusted administrators and operators, enforce least privilege on SQL Server accounts used by the application, rotate any credentials that may have been exposed, and monitor SQL Server access for unauthorized use. Limit network reachability to the SQL Server from only required hosts to reduce downstream impact if credentials are disclosed.

Remediation

Patch, then assume compromise.

Upgrade affected Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions products to a version that remediates CVE-2025-14816. The provided content identifies affected versions as GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, and AnalytiX version 10.97.3 and prior; GENESIS version 11.02 and prior; and MC Works64 all versions. Apply the vendor's security update or fixed release for the relevant product line as soon as available and verify that the Hyper Historian Splitter GUI no longer exposes SQL credentials in plain text.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Mitsubishi Electric CorporationAnalytixapplication

Mitsubishi Electric CorporationGenesisapplication

Mitsubishi Electric CorporationGenesis64application

Mitsubishi Electric CorporationHyper Historianapplication

Mitsubishi Electric CorporationIconics Suiteapplication

Mitsubishi Electric CorporationMc Works64application

Mitsubishi Electric CorporationMobilehmiapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

3 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2