# Critical Password Storage Flaw Exposes SQL Credentials in Mitsubishi Electric Industrial Control Systems
Mitsubishi Electric has disclosed a significant vulnerability affecting its widely-deployed GENESIS64 and ICONICS Suite industrial control software, revealing plaintext storage of SQL Server credentials in local cache files. The flaws, tracked as CVE-2025-14815 and CVE-2025-14816, carry a severity rating of 8.8 and pose substantial risks to manufacturing operations and critical infrastructure installations worldwide.
## The Threat
The vulnerability stems from a dangerous credential management practice: when local caching using SQLite is enabled alongside SQL Server authentication, the affected products store database credentials in cleartext within SQLite database files. An attacker gaining local system access could extract these credentials and use them to compromise the underlying database, potentially exfiltrating sensitive data, altering production records, or triggering denial-of-service conditions across an entire facility.
This is not a remote vulnerability—it requires local access to the compromised system. However, in industrial environments where multiple operators, contractors, and service personnel interact with control systems, the local attack surface can be substantially larger than in typical enterprise settings.
## Technical Details
The Core Issue: The vulnerability represents a fundamental departure from security best practices around credential storage. Rather than implementing standard protections—such as hashing, encryption, or secure credential managers—the affected Mitsubishi products elected to store SQL authentication tokens directly within local SQLite cache files with no encryption or obfuscation.
How It Works:
When an operator configures a Mitsubishi GENESIS or ICONICS application to use SQL Server authentication with local caching enabled, the system creates SQLite database files to improve performance and availability. Within these cache files, SQL Server credentials remain visible in plaintext format. Any user with sufficient file system permissions—or an attacker who has compromised a user account—can read these files directly and extract credentials.
Affected Products:
| Product | Vulnerable Versions |
|---------|-------------------|
| GENESIS64 | ≤ 10.97.3 |
| ICONICS Suite | ≤ 10.97.3 |
| MobileHMI | ≤ 10.97.3 |
| Hyper Historian | ≤ 10.97.3 |
| AnalytiX | ≤ 10.97.3 |
| MC Works 64 | All versions |
| GENESIS | ≤ 11.02 |
The breadth of affected product lines suggests this vulnerability may have existed for several years, persisting across multiple application architectures within Mitsubishi's industrial software portfolio.
## Why This Matters for Critical Infrastructure
Mitsubishi's GENESIS and ICONICS platforms serve as supervisory control and data acquisition (SCADA) systems and human-machine interfaces (HMI) in manufacturing plants, utilities, and other critical infrastructure environments. These systems often operate with elevated access to production databases that contain:
A compromised SQL Server account could grant attackers the ability to manipulate production data, introduce faults into automated systems, or deny operators access to essential information during critical operations.
## Remediation Strategy
Mitsubishi has released patched versions addressing both vulnerabilities. Organizations must take a two-step approach to fully remediate the risk.
Immediate Actions:
1. Upgrade to patched versions:
- GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX: Version 10.98 or later
- GENESIS: Version 11.03 or later
- MC Works 64: Currently no fix planned; rely on compensating controls
2. After upgrading, disable local caching:
- Open the Workbench configuration utility
- Navigate to "Configure Application(s) Settings"
- Uncheck the "Local Cache" column for all applications in the "Available Applications" list
3. Remove existing cache files:
- For GENESIS64/ICONICS (version 10.x): Delete all files from C:\ProgramData\ICONICS\Cache\*.sdf
- For GENESIS (version 11.x): Delete all files from C:\ProgramData\ICONICS\11\Cache\*.sqlite3
Critical Note: Disabling local caching may impact application performance during SQL Server connectivity issues, as the applications will no longer be able to serve data from local cache. Organizations should evaluate this tradeoff against their operational requirements and implement testing before deploying to production environments.
## Operational Impact Considerations
For facilities running MC Works 64, where no patch is currently available, the remediation strategy is limited to compensating controls:
Organizations should also review database permissions to ensure SQL Server accounts used by GENESIS and ICONICS applications operate with the minimum privileges necessary, limiting the scope of damage should those credentials be compromised.
## HackWire Analysis
This vulnerability reflects a broader pattern in industrial software: the security implementation lag between consumer and enterprise software and control system platforms. While modern applications increasingly encrypt sensitive data at rest and in transit, industrial control software often operates on architectural foundations built decades ago, where security assumptions differed fundamentally.
The plaintext credential storage in SQLite files is egregious by modern standards, yet it likely persisted undetected because Mitsubishi's systems operate in environments with different threat models—historically, attacks on industrial systems came from the network, not from trusted local users. That assumption no longer holds in an era of supply chain compromise, insider threats, and increasing sophistication in facility-level attack campaigns.
The presence of "no fix planned" for MC Works 64 is particularly concerning. Organizations running this legacy product should accelerate migration planning and implement aggressive compensating controls immediately. Mitsubishi's willingness to support one product line while abandoning another suggests that organizations should not assume future updates will address emerging issues in aging product lines.
For security teams managing these environments, this disclosure underscores the importance of treating industrial control systems as high-value targets worthy of the same security rigor applied to financial or healthcare systems. Credential enumeration within control system networks should be treated as a critical incident, and regular audits of database access within manufacturing environments should become standard practice.