Mitsubishi Electric GENESIS up to 11.03/10.97.3 Password Recovery password recovery

Summaryinfo

A vulnerability was found in Mitsubishi Electric GENESIS, GENESIS32, GENESIS64, Hyper Historian, ICONICS Suite, IoTWorX, MC Works64, MobileHMI, BizViz and AnalytiX up to 11.03/10.97.3. It has been rated as critical. Affected by this issue is some unknown functionality of the component Password Recovery. This manipulation causes password recovery. This vulnerability appears as CVE-2026-16436. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical was found in Mitsubishi Electric GENESIS, GENESIS32, GENESIS64, Hyper Historian, ICONICS Suite, IoTWorX, MC Works64, MobileHMI, BizViz and AnalytiX up to 11.03/10.97.3. Affected by this vulnerability is an unknown function of the component Password Recovery. The manipulation with an unknown input leads to a password recovery vulnerability. The CWE definition for the vulnerability is CWE-640. The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

The advisory is shared at mitsubishielectric.com. This vulnerability is known as CVE-2026-16436 since 07/21/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/15/2026). MITRE ATT&CK project uses the attack technique T1552 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-101939). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Mitsubishi Electric

Name

• AnalytiX
• BizViz
• GENESIS
• GENESIS32
• GENESIS64
• Hyper Historian
• ICONICS Suite
• IoTWorX
• MC Works64
• MobileHMI

Version

• 10.97.0
• 10.97.1
• 10.97.2
• 10.97.3
• 11.03

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion