Genesis32
Monthly
CVE-2026-16437 lets a locally authenticated administrator defeat the forgotten-password recovery mechanism in Mitsubishi Electric's ICONICS-based GENESIS (11.03 and prior), GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX (10.97.3 and prior) products, as well as all versions of MC Works64, GENESIS32 and BizViz, by tampering with the Windows-protected management file that stores the system-unlock challenge response - effectively unlocking the system without knowing the password. The impact ratings are high across confidentiality, integrity and availability, so a successful attacker could disclose, alter or destroy internal configuration data or drive the host into a denial-of-service condition. Realistic risk is tempered by the local-only vector, high attack complexity and the requirement for pre-existing administrative rights on the host; no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied for this CVE. Vendor CVSS is 7.1 (HIGH).
Remote, unauthenticated attackers can unlock Mitsubishi Electric's ICONICS GENESIS, GENESIS64, ICONICS Suite and related SCADA/HMI products by obtaining the system's challenge-response unlock value, which the vendor confirms is fixed and identical for every user and every installation, after which the attacker can disclose, tamper with, destroy or delete internal information or force the system into a denial-of-service condition. Affected builds are GENESIS 11.03 and prior, GENESIS64/ICONICS Suite/Hyper Historian/AnalytiX/MobileHMI/IoTWorX 10.97.3 and prior, and MC Works64, GENESIS32 and BizViz at all versions. The vendor assigns CVSS 4.0 a 9.2 score, while our independent CVSS 3.1 assessment lands at 8.1 (AV:N/AC:H/PR:N/UI:N) because exploitation hinges on the one-time prerequisite of acquiring the static challenge response (the CVSS 4.0 AT:P attack requirement); no public exploit code and no confirmed active exploitation were identified at time of analysis, so the risk driver is the universal reusability of a single leaked value rather than any observed campaign.
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0, 8.02, 8.04, and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML document. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.
The lockout-recovery feature in the Security Configurator component in ICONICS GENESIS32 9.22 and earlier and BizViz 9.22 and earlier uses an improper encryption algorithm for generation of an. Rated medium severity (CVSS 4.4). No vendor patch available.
CVE-2026-16437 lets a locally authenticated administrator defeat the forgotten-password recovery mechanism in Mitsubishi Electric's ICONICS-based GENESIS (11.03 and prior), GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX (10.97.3 and prior) products, as well as all versions of MC Works64, GENESIS32 and BizViz, by tampering with the Windows-protected management file that stores the system-unlock challenge response - effectively unlocking the system without knowing the password. The impact ratings are high across confidentiality, integrity and availability, so a successful attacker could disclose, alter or destroy internal configuration data or drive the host into a denial-of-service condition. Realistic risk is tempered by the local-only vector, high attack complexity and the requirement for pre-existing administrative rights on the host; no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied for this CVE. Vendor CVSS is 7.1 (HIGH).
Remote, unauthenticated attackers can unlock Mitsubishi Electric's ICONICS GENESIS, GENESIS64, ICONICS Suite and related SCADA/HMI products by obtaining the system's challenge-response unlock value, which the vendor confirms is fixed and identical for every user and every installation, after which the attacker can disclose, tamper with, destroy or delete internal information or force the system into a denial-of-service condition. Affected builds are GENESIS 11.03 and prior, GENESIS64/ICONICS Suite/Hyper Historian/AnalytiX/MobileHMI/IoTWorX 10.97.3 and prior, and MC Works64, GENESIS32 and BizViz at all versions. The vendor assigns CVSS 4.0 a 9.2 score, while our independent CVSS 3.1 assessment lands at 8.1 (AV:N/AC:H/PR:N/UI:N) because exploitation hinges on the one-time prerequisite of acquiring the static challenge response (the CVSS 4.0 AT:P attack requirement); no public exploit code and no confirmed active exploitation were identified at time of analysis, so the risk driver is the universal reusability of a single leaked value rather than any observed campaign.
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0, 8.02, 8.04, and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML document. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.
The lockout-recovery feature in the Security Configurator component in ICONICS GENESIS32 9.22 and earlier and BizViz 9.22 and earlier uses an improper encryption algorithm for generation of an. Rated medium severity (CVSS 4.4). No vendor patch available.