This vulnerability is caused by cleartext storage and display of SQL Server credentials in the Hyper Historian Splitter feature. When SQL authentication is used, a local attacker can view these credentials in the application’s GUI. With the credentials, the attacker can log into the SQL Server and potentially read, modify, or delete data, and may trigger a denial‑of‑service incident. The weakness aligns with CWE‑317, which describes insecure storage of sensitive information.

The flaw affects Mitsubishi Electric products that include the Hyper Historian Splitter UI. Affected versions are GENESIS64 up to and including 10.97.3, GENESIS up to 11.02, ICONICS Suite up to 10.97.3, MobileHMI up to 10.97.3, Hyper Historian up to 10.97.3, AnalytiX up to 10.97.3, and MC Works64 in all released versions. The same range applies to the Iconics Digital Solutions line (GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, and GENESIS).

The advisory rates the vulnerability with a CVSS score of 9.3, indicating high severity. The EPSS score is not available, but the lack of a KEV listing does not reduce the threat. Because the attacker must be local, the attack vector is physical or local system access. However, the high severity reflects the potential to compromise SQL Server credentials and thereby obtain full control over critical data, leading to espionage, tampering, or downtime.