CVE-2026-16437: CWE-640 Weak Password Recovery Mechanism for Forgotten Password in Mitsubishi Electric Corporation GENESIS

CVE-2026-16437 describes a weakness in the password recovery mechanism of Mitsubishi Electric GENESIS and related software versions. Authenticated local users with administrative privileges can manipulate the management file that stores the challenge response used for password recovery. Although the file is protected by Windows permissions, administrators have read/write access, which can be exploited to disclose, modify, or delete sensitive internal information or cause denial-of-service. The vulnerability affects multiple products and versions, including GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, and others as listed. A patch is available to address this issue.

An authenticated local administrator can exploit this vulnerability to disclose, tamper with, destroy, or delete internal information related to the password recovery mechanism. This could also lead to denial-of-service conditions on the affected system. The impact is limited to users with administrative privileges and local access.

A patch is available for this vulnerability and should be applied to affected systems. Since the vulnerability requires local administrative access, restricting such access and applying the official fix will mitigate the risk. No additional vendor advisory details were provided, so check the vendor's official resources for the patch and further guidance.