Mitsubishi GENESIS Static Unlock Code Critical Flaw Exposes Systems to Remote Access Risk

Mitsubishi Electric’s GENESIS industrial software contains a critical flaw that allows remote attackers to bypass password recovery mechanisms entirely. The issue stems from a weak implementation where the system uses a static, predictable value to verify unlock attempts, rather than generating unique challenges for each session. This design error enables unauthorized users to gain access without knowing any valid credentials.

Root cause

The underlying weakness is classified as CWE-640, indicating a weak password recovery mechanism. According to the National Vulnerability Database, the challenge response used to unlock the system is common to all users and remains fixed across different sessions. This means the verification token does not change, allowing an attacker to determine or reuse the correct response value to satisfy the system’s authentication requirement.

Attack path

A remote attacker can exploit this flaw by obtaining the fixed challenge response through various means. Once the correct static value is known or intercepted, the attacker can submit it to the system to trigger an unlock sequence. This bypasses standard authentication controls, granting the attacker the ability to interact with the software as if they had successfully recovered a forgotten password.

Affected versions

The vulnerability impacts a wide range of Mitsubishi Electric and Iconics Digital Solutions products. Affected versions include GENESIS 11.03 and prior, GENESIS64 10.97.3 and prior, ICONICS Suite 10.97.3 and prior, Hyper Historian 10.97.3 and prior, AnalytiX 10.97.3 and prior, MobileHMI 10.97.3 and prior, and IoTWorX 10.97.3 and prior. Additionally, all versions of MC Works64, GENESIS32, and BizViz are affected.

Mitigation

No patch or fix has been confirmed yet by the vendor. Security teams should assume that any system running the affected versions is vulnerable to remote unlock attempts. Isolation of these systems from untrusted networks may reduce exposure, but it does not eliminate the risk if internal access is compromised.

Why it matters

Static challenge responses represent a fundamental failure in authentication design. When a system uses the same verification token for every user and every session, it removes the unpredictability required to prevent replay attacks. Teams usually rely on dynamic tokens that expire quickly or are unique to each request. Without this variability, an attacker only needs to discover the single correct value once. This flaw highlights why relying on fixed secrets for recovery is dangerous, as it effectively shares the master key with anyone who can observe or deduce the response mechanism.

Background: National Vulnerability Database

The National Vulnerability Database provides standard identifiers for software flaws. You use these identifiers to automate patching and verify vendor claims. Small teams should cross-reference database entries with their IT asset inventory to prioritise fixes and avoid wasting time on irrelevant alerts.

Read the full guide: National Vulnerability Database: Small Business Action Plan

What to do and how to stay safe: Mitsubishi Electric

• Verify whether your environment runs any of the affected Mitsubishi or Iconics versions listed in the advisory.
• Restrict network access to these systems, ensuring they are not reachable from untrusted or external networks.
• Monitor logs for unusual unlock attempts or successful logins that do not correspond to standard administrative actions.
• Prepare to apply updates immediately once the vendor releases a confirmed patch for CVE-2026-16436.

Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-16436?

The vulnerability has a CVSS score of 9.2, which is rated as critical.

Which specific Mitsubishi products are affected?

GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz are all affected.

Can an attacker delete data using this flaw?

Yes, the description states an attacker may disclose, tamper with, destroy, or delete internal information.