Genesis64 CVE-2025-14816

Real-world risk is substantial but contextual. The CVSS 9.3 Critical rating reflects the severe downstream impact once credentials are obtained-full SQL Server compromise with data exfiltration, modification, and destruction capabilities plus potential denial-of-service. However, the Local attack vector (AV:L) and low-privilege requirement (PR:L) significantly constrain the threat model: attackers need prior authenticated access to the HMI workstation or engineering station running these applications. No EPSS score is provided in available data, and CISA KEV status is not indicated, suggesting no confirmed active exploitation in the wild as of this analysis. The CISA ICS advisory (ICSA-26-097-01) and Japanese JPCERT coordination (JVNVU90646130) indicate government awareness and coordination with critical infrastructure sectors. The SSVC technical impact is clearly HIGH (complete system compromise of subsequent SQL Server), but exploitation is NOT automatable (requires GUI access and human observation) and exploitation status shows no public POC. Priority should be elevated for organizations where HMI workstations have multiple users with varying trust levels, shared terminal access, or insufficient physical/logical access controls. The risk is lower in environments with strict single-user HMI deployments and robust access management, though the 'all versions' statement for MC Works64 indicates a long-standing design flaw requiring immediate architectural remediation.

An insider threat or attacker who has compromised a low-privilege domain account gains access to an HMI engineering workstation running Mitsubishi Electric GENESIS64 with Hyper Historian Splitter configured for SQL authentication. The attacker launches the Hyper Historian configuration GUI and navigates to the database connection settings, where SQL Server credentials are displayed in plaintext without masking. The attacker photographs or transcribes the credentials, then uses them from a separate network-connected system to authenticate directly to the backend SQL Server. With full database access, the attacker exfiltrates historical process data, modifies alarm thresholds to hide malicious activity, or deletes critical operational records to cause process disruptions. No public exploit code is required as the vulnerability is a design flaw exploitable through normal application usage.