ICONICS GENESIS64 CVE-2026-16437

Exploitation requires an already-authenticated LOCAL user holding ADMINISTRATIVE privileges on the host running the affected ICONICS/Mitsubishi GENESIS product. The specific prerequisite is read/write access to the management file that stores the system-unlock challenge response - administrators can read and write this file, and the attack consists of tampering with it to defeat the forgotten-password recovery mechanism (CWE-640) and unlock the system. Limiting factors that reduce realistic risk: there is no network vector (AV:L, local only); PR:H means standard or unprivileged users cannot exploit it; AC:H indicates non-trivial effort, consistent with the file being protected by Windows (so the attacker must work within or around Windows ACLs); and no user interaction is needed (UI:N). MC Works64, GENESIS32, and BizViz are listed as affected in ALL versions, while GENESIS is affected at 11.03 and prior and GENESIS64/ICONICS Suite/Hyper Historian/AnalytiX/MobileHMI/IoTWorX at 10.97.3 and prior.

This is a high-CVSS-but-moderate-real-risk issue in practice. The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:H/UI:N, score 7.1) describes a vulnerability requiring LOCAL access, HIGH attack complexity, and HIGH privileges (administrative) - an attacker must already be an authenticated local administrator before abusing the weak password-recovery mechanism (CWE-640) by tampering with the challenge-response management file. That is a demanding precondition that sharply limits real-world risk. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided in the input, so exploitation-probability signals are absent rather than high. No SSVC decision data was supplied. The key tension is the high VC/VI/VA (High confidentiality, integrity, and availability impact on the vulnerable system) against the PR:H/AV:L/AC:H gating: the potential impact is severe (data disclosure, tampering, destruction, or DoS of an ICS/SCADA system) but only reachable by someone who already holds local admin rights, making this primarily a privilege-boundary/trust-model weakness rather than an externally exploitable flaw. Net: a real but lower-priority issue for most environments - meaningful for insider-threat and defense-in-depth modeling in industrial settings, not an urgent remote-exploitation emergency.

An authenticated local administrator on a host running ICONICS/Mitsubishi GENESIS software reads and modifies the Windows-protected management file storing the system-unlock challenge response, defeating the password-recovery mechanism to unlock the system. Having bypassed the lock, the attacker discloses or tampers with internal configuration and data, or deletes it to force a denial-of-service condition on the SCADA/HMI system. No public exploit code is known; the high attack complexity (AC:H) implies the tampering is non-trivial and may require specific knowledge of the file format.