Iotworx
Monthly
CVE-2026-16437 lets a locally authenticated administrator defeat the forgotten-password recovery mechanism in Mitsubishi Electric's ICONICS-based GENESIS (11.03 and prior), GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX (10.97.3 and prior) products, as well as all versions of MC Works64, GENESIS32 and BizViz, by tampering with the Windows-protected management file that stores the system-unlock challenge response - effectively unlocking the system without knowing the password. The impact ratings are high across confidentiality, integrity and availability, so a successful attacker could disclose, alter or destroy internal configuration data or drive the host into a denial-of-service condition. Realistic risk is tempered by the local-only vector, high attack complexity and the requirement for pre-existing administrative rights on the host; no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied for this CVE. Vendor CVSS is 7.1 (HIGH).
Remote, unauthenticated attackers can unlock Mitsubishi Electric's ICONICS GENESIS, GENESIS64, ICONICS Suite and related SCADA/HMI products by obtaining the system's challenge-response unlock value, which the vendor confirms is fixed and identical for every user and every installation, after which the attacker can disclose, tamper with, destroy or delete internal information or force the system into a denial-of-service condition. Affected builds are GENESIS 11.03 and prior, GENESIS64/ICONICS Suite/Hyper Historian/AnalytiX/MobileHMI/IoTWorX 10.97.3 and prior, and MC Works64, GENESIS32 and BizViz at all versions. The vendor assigns CVSS 4.0 a 9.2 score, while our independent CVSS 3.1 assessment lands at 8.1 (AV:N/AC:H/PR:N/UI:N) because exploitation hinges on the one-time prerequisite of acquiring the static challenge response (the CVSS 4.0 AT:P attack requirement); no public exploit code and no confirmed active exploitation were identified at time of analysis, so the risk driver is the universal reusability of a single leaked value rather than any observed campaign.
CVE-2026-16437 lets a locally authenticated administrator defeat the forgotten-password recovery mechanism in Mitsubishi Electric's ICONICS-based GENESIS (11.03 and prior), GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX (10.97.3 and prior) products, as well as all versions of MC Works64, GENESIS32 and BizViz, by tampering with the Windows-protected management file that stores the system-unlock challenge response - effectively unlocking the system without knowing the password. The impact ratings are high across confidentiality, integrity and availability, so a successful attacker could disclose, alter or destroy internal configuration data or drive the host into a denial-of-service condition. Realistic risk is tempered by the local-only vector, high attack complexity and the requirement for pre-existing administrative rights on the host; no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied for this CVE. Vendor CVSS is 7.1 (HIGH).
Remote, unauthenticated attackers can unlock Mitsubishi Electric's ICONICS GENESIS, GENESIS64, ICONICS Suite and related SCADA/HMI products by obtaining the system's challenge-response unlock value, which the vendor confirms is fixed and identical for every user and every installation, after which the attacker can disclose, tamper with, destroy or delete internal information or force the system into a denial-of-service condition. Affected builds are GENESIS 11.03 and prior, GENESIS64/ICONICS Suite/Hyper Historian/AnalytiX/MobileHMI/IoTWorX 10.97.3 and prior, and MC Works64, GENESIS32 and BizViz at all versions. The vendor assigns CVSS 4.0 a 9.2 score, while our independent CVSS 3.1 assessment lands at 8.1 (AV:N/AC:H/PR:N/UI:N) because exploitation hinges on the one-time prerequisite of acquiring the static challenge response (the CVSS 4.0 AT:P attack requirement); no public exploit code and no confirmed active exploitation were identified at time of analysis, so the risk driver is the universal reusability of a single leaked value rather than any observed campaign.