Cyber Resilience

CVE-2025-14816

Published
08 April 2026
Modified
24 July 2026
CVSS Score v4 9.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0010 1th percentile
Risk Priority 31 floored blend · peak EPSS

Summary

CVE-2025-14816 is a critical-severity Cleartext Storage of Sensitive Information in GUI (CWE-317) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Screen Capture (T1113); ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to IA-6 (Authentication Feedback) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Cleartext Storage of Sensitive Information in GUI vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi…

more

Electric AnalytiX versions 10.97.3 and prior, Mitsubishi Electric GENESIS versions 11.02 and prior, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.3 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.02 and prior allows a local attacker to disclose the SQL Server credentials displayed in plain text in the GUI of the Hyper Historian Splitter feature by exploiting this vulnerability, when SQL authentication is used for the SQL Server authentication. As a result, the unauthorized attacker could access the SQL Server and disclose, tamper with, or destroy data on the server, potentially cause a denial-of-service (DoS) condition on the system.

CWE(s)
CWE-317

Related Threats

MITRE ATT&CK Enterprise Techniques

T1113 Screen Capture Collection
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-24431Shared CWE-317
CVE-2026-27516Shared CWE-317

Affected Assets

—
Mitsubishi Electric GENESIS64
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

IA-6 Authentication Feedback partial match

Obscures authentication feedback in the GUI, directly stopping cleartext display of sensitive credentials.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 mostly match
prevents

Protecting data-at-rest confidentiality directly prevents cleartext GUI storage of sensitive data.

PR.DS-10 partial match
prevents

Protecting data-in-use confidentiality mitigates in-memory GUI exposure but does not address persisted storage.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.11 Data masking full match
degrades

Data masking directly prevents cleartext display of sensitive GUI data.

A.8.24 Use of cryptography partial match
prevents

Cryptography can protect data at rest/display, but does not mandate GUI-level masking.

A.8.26 Application security requirements partial match
prevents

Application security requirements may include masking rules, yet the control is wider than this CWE.

A.8.28 Secure coding partial match
prevents

Secure coding practices can prevent the weakness but do not address the control's broader scope.

A.8.3 Information access restriction partial match
degrades

Access restriction limits who sees the GUI, but does not address cleartext storage itself.

References