This vulnerability (CVE-2025-14815) affects Mitsubishi Electric GENESIS64 and several related products up to specified versions. It arises from storing SQL Server credentials in cleartext within a local SQLite file used for caching when SQL authentication is enabled. An attacker with local access and low privileges can extract these plaintext credentials, enabling unauthorized SQL Server access. The vulnerability can lead to data disclosure, modification, destruction, or denial-of-service on the SQL Server. The CVSS 4.0 vector indicates low attack complexity and privileges required, no user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No patch or official remediation level is currently documented.

The vulnerability allows a local attacker to disclose SQL Server credentials stored in plaintext, which can lead to unauthorized access to the SQL Server. This unauthorized access may result in disclosure, tampering, or destruction of data, and potentially cause denial-of-service conditions on the affected system. Given the critical CVSS score of 9.3, the impact on confidentiality, integrity, and availability is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict local access to systems running affected Mitsubishi Electric products, disable local caching with SQLite if feasible, or avoid using SQL authentication to reduce exposure. Monitor vendor communications for updates regarding patches or official mitigations.