CVE-2026-16436: CWE-640 Weak Password Recovery Mechanism for Forgotten Password in Mitsubishi Electric Corporation GENESIS

The vulnerability CVE-2026-16436 (CWE-640) affects Mitsubishi Electric GENESIS and related products through a weak password recovery mechanism. The challenge response used for password recovery is fixed and common to all users, enabling remote attackers to unlock the system without proper authorization. This flaw impacts multiple versions of GENESIS (<=11.03), GENESIS64 (<=10.97.3), ICONICS Suite (<=10.97.3), Hyper Historian (<=10.97.3), AnalytiX (<=10.97.3), MobileHMI (<=10.97.3), IoTWorX (<=10.97.3), and all versions of MC Works64, GENESIS32, and BizViz. The vulnerability can lead to unauthorized access resulting in information disclosure, tampering, destruction, deletion, or denial-of-service. The CVSS 4.0 score is 9.2 (critical). The vendor provides a patch and manages remediation for these cloud-hosted services.

Exploitation of this vulnerability allows remote attackers to bypass authentication by using a fixed, common challenge response in the password recovery mechanism. This can lead to unauthorized disclosure, modification, destruction, or deletion of internal information, or cause denial-of-service conditions in affected systems.

A patch is available for this vulnerability. Since the affected products are cloud-hosted services, Mitsubishi Electric Corporation manages remediation server-side. Users should verify with the vendor advisory to ensure their systems are updated and the vulnerability is mitigated.