This vulnerability arises from a weak password recovery mechanism that stores a challenge response in a local management file. An authenticated local administrator can manipulate this file, bypassing normal authentication controls and unlocking the system. The flawed design allows the attacker to read, modify, delete, or destroy the file, which can lead to disclosure of internal credentials, corruption of configuration data, or denial‑of‑service conditions. The weakness is an authentication bypass flaw classified as CWE‑640.

The affected products are Mitsubishi Electric Corporation and Mitsubishi Electric Iconics Digital Solutions offerings, including AnalytiX, BizViz, GENESIS, GENESIS32, GENESIS64, Hyper Historian, ICONICS Suite, IoTWorX, MC Works64, and MobileHMI. Vulnerable versions are GENESIS 11.03 and earlier, GENESIS64 10.97.3 and earlier, ICONICS Suite 10.97.3 and earlier, Hyper Historian 10.97.3 and earlier, AnalytiX 10.97.3 and earlier, MobileHMI 10.97.3 and earlier, IoTWorX 10.97.3 and earlier, and all versions of MC Works64, GENESIS32, and BizViz.

With a CVSS score of 7.1 the vulnerability has moderate to high severity, but the EPSS score of less than 1% suggests exploitation is currently unlikely. The flaw requires local administrative privileges and leverages a protected Windows file, so the attack vector is local and privilege‑elevated. Although it is not listed in the CISA KEV catalog, organizations that maintain privileged local administrators or reuse weak credentials face a higher risk. The impact includes potential data disclosure, integrity compromise, or even denial‑of‑service if the challenge response file is corrupted or deleted.