CVE-2026-16436
Received Received - Intake

Weak Password Recovery in Mitsubishi Electric ICONICS Suite

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Mitsubishi Electric Corporation

Description
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-16436
EUVD
EUVD-2026-101939

Affected Vendors & Products

Showing 19 associated CPEs
Vendor Product Version / Range
Mitsubishi Electric Corporation GENESIS versions 11.03 and prior
Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior
Mitsubishi Electric Corporation GENESIS64 versions 10.97.3 and prior
Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior
Mitsubishi Electric Corporation ICONICS Suite versions 10.97.3 and prior
Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior
Mitsubishi Electric Corporation Hyper Historian versions 10.97.3 and prior
Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior
Mitsubishi Electric Corporation AnalytiX versions 10.97.3 and prior
Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.3 and prior
Mitsubishi Electric Corporation MobileHMI versions 10.97.3 and prior
Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.3 and prior
Mitsubishi Electric Corporation IoTWorX versions 10.97.3 and prior
Mitsubishi Electric Iconics Digital Solutions IoTWorX versions 10.97.3 and prior
Mitsubishi Electric Corporation MC Works64 all versions
Mitsubishi Electric Corporation GENESIS32 all versions
Mitsubishi Electric Iconics Digital Solutions GENESIS32 all versions
Mitsubishi Electric Corporation BizViz all versions
Mitsubishi Electric Iconics Digital Solutions BizViz all versions

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-16436 is an authentication bypass vulnerability in multiple Mitsubishi Electric products. It occurs due to a weak password recovery mechanism where the challenge response used to unlock systems is common and fixed for all users. This allows attackers who obtain the challenge response to bypass authentication and gain unauthorized access.

Detection Guidance

Detecting this vulnerability requires checking for the presence of affected Mitsubishi Electric products and verifying if they use the weak password recovery mechanism. Inspect installed software versions against the affected ranges listed in the CVE. Check for the presence of specific .dat files related to the security challenge feature, such as those mentioned in mitigation steps. Network scanning tools can identify exposed services or ports associated with these products.

Impact Analysis

An attacker could exploit this vulnerability to disclose sensitive information, tamper with or destroy data, or cause the affected system to crash in a denial-of-service condition. Unauthorized access may also lead to further compromise of the system or network.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, and other regulations. Failure to address it may result in legal penalties, loss of trust, and reputational damage.

Mitigation Strategies
  • Upgrade affected products to fixed versions where available, such as ICONICS Suite 10.98 or later, IoTWorX 10.98 or later, and GENESIS 11.04 or later.
  • For products without fixed versions, restrict network access using firewalls and limit exposure to trusted networks only.
  • Delete and recreate specific .dat files related to the security challenge feature as outlined in the vendor advisory.
  • Restrict file access permissions to unique administrator accounts to prevent unauthorized modifications.
  • Install and update antivirus software to detect potential exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16436. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart