Weak Password Recovery Mechanism in Mitsubishi Electric GENESIS and Other Products

CVE-2026-16437

What is CVE-2026-16437?

A vulnerability exists within the password recovery mechanism of several Mitsubishi Electric products, including GENESIS and ICONICS Suite. Authenticated local users with administrative privileges can exploit this vulnerability by tampering with a management file that holds challenge-response data, which is intended to securely handle password recovery operations. Although this file is protected by Windows, administrators can read and write to it, thereby allowing an attacker to potentially access, modify, or delete sensitive internal information. This exploitation may result in unauthorized access or a denial-of-service condition in the affected systems.

References