Mitsubishi Electric GENESIS: Weak password recovery mechanism
Summary
Several Mitsubishi Electric and ICONICS industrial automation and SCADA/HMI products use a password recovery mechanism with a fixed challenge response shared by all users. A remote attacker who obtains this response can unlock the system and may disclose, tamper with or delete information or cause a denial-of-service condition. The CVSS v4 base score is 9.2 (critical), and CISA rates exploitation as not observed and automatable as no.
Affected
- GENESIS 11.03 and prior
- GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX 10.97.3 and prior
- MC Works64, GENESIS32 and BizViz: all versions
- Exact version ranges should be confirmed in the vendor advisory.
Fixed in
- GENESIS: fix in version 11.04 or later (secondary source, verify in vendor advisory)
- GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX: Unknown.
- MC Works64, GENESIS32, BizViz: No fix planned by the vendor.
Workaround
- No vendor-approved workaround for the password recovery flaw is known.
- Vendor recommends anti-virus software on the affected PC; this does not address the flaw and is only a weak interim measure.
- For products without a fix: isolate systems from untrusted networks, restrict access to engineering and HMI hosts, and use a firewall or VPN with MFA for remote access.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV at the time of research.
- No public proof-of-concept found.
- EPSS score is low.
Our recommendation
- Inventory all systems running the listed products and check their exposure to internet and remote access.
- Update GENESIS to 11.04 or later and obtain the other fixes from the vendor advisory 2026-006.
- Plan migration for MC Works64, GENESIS32 and BizViz, as no fix is planned.
- Restrict network access to these systems and monitor for unusual access and changes; check CISA KEV and the vendor page for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mitsubishi Electric Security Advisory 2026-006 www.mitsubishielectric.com
- CISA ICS Advisory ICSA-26-300-02 www.cisa.gov
- NVD record via Vulners vulners.com
- Vulnrichment EPSS data via Vulners vulners.com
- Security Boulevard daily OT security news, 28 Oct 2026 securityboulevard.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:23.
Original description (NVD)
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.