Genesis64 CVE-2025-14815

Real-world risk is significant but context-dependent. The CVSS 9.3 score reflects worst-case downstream impact where compromised SQL Server credentials enable extensive database manipulation in industrial environments. Attack requirements are straightforward: local authenticated access (PR:L) with low complexity (AC:L), making this exploitable by malicious insiders, compromised operator accounts, or attackers who have already gained initial foothold through other vectors. CISA ICS advisory ICSA-26-097-01 publication indicates concern for critical infrastructure sectors. However, exploitation requires specific preconditions: local SQLite caching must be enabled AND SQL authentication (not Windows authentication) must be in use, limiting the actual attack surface. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept identified at time of analysis, suggesting this remains primarily a vendor-disclosed configuration weakness rather than an actively targeted vulnerability. Priority should be highest for industrial facilities using affected versions with SQL authentication in environments where insider threat or workstation compromise risk is elevated.

An attacker with local authenticated access to an HMI workstation running vulnerable Mitsubishi GENESIS64 10.97.3 navigates to the SQLite cache database directory and copies the local database file to offline storage. Using SQLite database tools, the attacker opens the file and extracts plaintext SQL Server credentials stored in configuration tables. With these credentials, the attacker remotely authenticates to the industrial facility's SQL Server hosting historian data, alarms, and process information, then executes SQL commands to modify production setpoints in the database, delete audit logs, or trigger denial-of-service by corrupting critical tables, potentially causing operational disruption or unsafe process conditions. No public exploit code identified at time of analysis, but exploitation requires only standard SQLite database access tools and basic SQL knowledge.