CVE-2025-10314 Overview
An Incorrect Default Permissions vulnerability has been identified in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2. This vulnerability allows a local attacker to execute arbitrary code with system privileges by replacing service executable files (EXE) or DLLs in the installation directory with specially crafted files. As a result, an attacker may be able to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a Denial of Service (DoS) condition on the affected system.
Critical Impact
Local privilege escalation to SYSTEM-level access enabling complete system compromise, data exfiltration, tampering, or denial of service on industrial control system (ICS) workstations running FREQSHIP-mini software.
Affected Products
- Mitsubishi Electric FREQSHIP-mini for Windows version 8.0.0
- Mitsubishi Electric FREQSHIP-mini for Windows version 8.0.1
- Mitsubishi Electric FREQSHIP-mini for Windows version 8.0.2
Discovery Timeline
- 2026-02-05 - CVE CVE-2025-10314 published to NVD
- 2026-02-05 - Last updated in NVD database
Technical Details for CVE-2025-10314
Vulnerability Analysis
This vulnerability stems from CWE-276 (Incorrect Default Permissions), where the FREQSHIP-mini installation process fails to properly restrict access permissions on its installation directory. When the software is installed, the default permissions allow low-privileged local users to modify or replace critical executable files and dynamic-link libraries (DLLs) that are loaded by Windows services running with elevated privileges.
The impact of successful exploitation is significant given that FREQSHIP-mini is industrial control system (ICS) software used for programming and configuring Mitsubishi Electric frequency inverters. Compromise of systems running this software could potentially affect industrial operations and manufacturing processes.
Root Cause
The root cause of this vulnerability lies in the installation routine's failure to enforce restrictive file system permissions on the program installation directory. By default, Windows services that execute from this directory run with SYSTEM privileges. When non-administrative users retain write access to this directory, they can leverage this misconfiguration to achieve privilege escalation through binary planting attacks.
Attack Vector
The attack requires local access to a system where FREQSHIP-mini is installed. An attacker with low-privilege access can identify the installation directory and its associated service executables or DLLs. By replacing a legitimate executable or DLL with a malicious payload, the attacker can achieve code execution in the context of the SYSTEM account when the service next loads the compromised binary.
The exploitation workflow involves:
- Identifying the FREQSHIP-mini installation directory (typically under C:\Program Files)
- Locating service executables or DLLs with overly permissive write permissions
- Replacing the legitimate binary with a malicious payload
- Waiting for or triggering the service to restart
- The malicious code executes with SYSTEM privileges
Detection Methods for CVE-2025-10314
Indicators of Compromise
- Unexpected modifications to executable files or DLLs within the FREQSHIP-mini installation directory
- Changed file hashes for known FREQSHIP-mini binaries compared to vendor-provided checksums
- New or modified files in the installation directory that do not match legitimate software updates
- Service crash events followed by unexpected process execution under SYSTEM context
Detection Strategies
- Monitor file integrity of the FREQSHIP-mini installation directory using file integrity monitoring (FIM) solutions
- Implement Windows Security Event monitoring for Event ID 4663 (file access attempts) on the installation directory
- Deploy endpoint detection and response (EDR) solutions to detect DLL hijacking and binary replacement attacks
- Audit service executable paths and verify digital signatures of loaded binaries
Monitoring Recommendations
- Enable auditing on the FREQSHIP-mini installation directory to log all write and modify operations
- Configure SentinelOne to alert on behavioral indicators associated with DLL hijacking and privilege escalation
- Establish baseline file hashes for all FREQSHIP-mini executables and DLLs for comparison during investigations
- Monitor Windows service control manager logs for unexpected service restarts or failures
How to Mitigate CVE-2025-10314
Immediate Actions Required
- Review and restrict file system permissions on the FREQSHIP-mini installation directory to prevent modification by non-administrative users
- Verify the integrity of all executable files and DLLs in the installation directory against known-good hashes
- Apply the vendor-provided update as referenced in the Mitsubishi Electric Vulnerability Report 2025-019
- Implement the principle of least privilege for all user accounts on systems running FREQSHIP-mini
Patch Information
Mitsubishi Electric has released security guidance for this vulnerability. Organizations should consult the official vendor advisory for patch availability and installation instructions:
Workarounds
- Manually correct file system permissions on the installation directory using the icacls command to remove write access for non-administrative users
- Isolate workstations running FREQSHIP-mini from general network access where possible
- Implement application whitelisting to prevent unauthorized executables from running in the installation directory
- Consider network segmentation for ICS workstations running vulnerable software
# Remediate directory permissions (run as Administrator)
# Remove inherited permissions and grant access only to Administrators and SYSTEM
icacls "C:\Program Files\FREQSHIP-mini" /inheritance:r
icacls "C:\Program Files\FREQSHIP-mini" /grant:r "BUILTIN\Administrators:(OI)(CI)F"
icacls "C:\Program Files\FREQSHIP-mini" /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F"
icacls "C:\Program Files\FREQSHIP-mini" /grant:r "BUILTIN\Users:(OI)(CI)RX"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
