CVE-2025-10314: FREQSHIP-mini Privilege Escalation Flaw

CVE-2025-10314 Overview

An Incorrect Default Permissions vulnerability has been identified in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2. This vulnerability allows a local attacker to execute arbitrary code with system privileges by replacing service executable files (EXE) or DLLs in the installation directory with specially crafted files. As a result, an attacker may be able to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a Denial of Service (DoS) condition on the affected system.

Critical Impact
Local privilege escalation to SYSTEM-level access enabling complete system compromise, data exfiltration, tampering, or denial of service on industrial control system (ICS) workstations running FREQSHIP-mini software.

Affected Products

Mitsubishi Electric FREQSHIP-mini for Windows version 8.0.0
Mitsubishi Electric FREQSHIP-mini for Windows version 8.0.1
Mitsubishi Electric FREQSHIP-mini for Windows version 8.0.2

Discovery Timeline

2026-02-05 - CVE CVE-2025-10314 published to NVD
2026-02-05 - Last updated in NVD database

Technical Details for CVE-2025-10314

Vulnerability Analysis

This vulnerability stems from CWE-276 (Incorrect Default Permissions), where the FREQSHIP-mini installation process fails to properly restrict access permissions on its installation directory. When the software is installed, the default permissions allow low-privileged local users to modify or replace critical executable files and dynamic-link libraries (DLLs) that are loaded by Windows services running with elevated privileges.

The impact of successful exploitation is significant given that FREQSHIP-mini is industrial control system (ICS) software used for programming and configuring Mitsubishi Electric frequency inverters. Compromise of systems running this software could potentially affect industrial operations and manufacturing processes.

Root Cause

The root cause of this vulnerability lies in the installation routine's failure to enforce restrictive file system permissions on the program installation directory. By default, Windows services that execute from this directory run with SYSTEM privileges. When non-administrative users retain write access to this directory, they can leverage this misconfiguration to achieve privilege escalation through binary planting attacks.

Attack Vector

The attack requires local access to a system where FREQSHIP-mini is installed. An attacker with low-privilege access can identify the installation directory and its associated service executables or DLLs. By replacing a legitimate executable or DLL with a malicious payload, the attacker can achieve code execution in the context of the SYSTEM account when the service next loads the compromised binary.

The exploitation workflow involves:

Identifying the FREQSHIP-mini installation directory (typically under C:\Program Files)
Locating service executables or DLLs with overly permissive write permissions
Replacing the legitimate binary with a malicious payload
Waiting for or triggering the service to restart
The malicious code executes with SYSTEM privileges

Detection Methods for CVE-2025-10314

Indicators of Compromise

Unexpected modifications to executable files or DLLs within the FREQSHIP-mini installation directory
Changed file hashes for known FREQSHIP-mini binaries compared to vendor-provided checksums
New or modified files in the installation directory that do not match legitimate software updates
Service crash events followed by unexpected process execution under SYSTEM context

Detection Strategies

Monitor file integrity of the FREQSHIP-mini installation directory using file integrity monitoring (FIM) solutions
Implement Windows Security Event monitoring for Event ID 4663 (file access attempts) on the installation directory
Deploy endpoint detection and response (EDR) solutions to detect DLL hijacking and binary replacement attacks
Audit service executable paths and verify digital signatures of loaded binaries

Monitoring Recommendations

Enable auditing on the FREQSHIP-mini installation directory to log all write and modify operations
Configure SentinelOne to alert on behavioral indicators associated with DLL hijacking and privilege escalation
Establish baseline file hashes for all FREQSHIP-mini executables and DLLs for comparison during investigations
Monitor Windows service control manager logs for unexpected service restarts or failures

How to Mitigate CVE-2025-10314

Immediate Actions Required

Review and restrict file system permissions on the FREQSHIP-mini installation directory to prevent modification by non-administrative users
Verify the integrity of all executable files and DLLs in the installation directory against known-good hashes
Apply the vendor-provided update as referenced in the Mitsubishi Electric Vulnerability Report 2025-019
Implement the principle of least privilege for all user accounts on systems running FREQSHIP-mini

Patch Information

Mitsubishi Electric has released security guidance for this vulnerability. Organizations should consult the official vendor advisory for patch availability and installation instructions:

Workarounds

Manually correct file system permissions on the installation directory using the icacls command to remove write access for non-administrative users
Isolate workstations running FREQSHIP-mini from general network access where possible
Implement application whitelisting to prevent unauthorized executables from running in the installation directory
Consider network segmentation for ICS workstations running vulnerable software

bash

# Remediate directory permissions (run as Administrator)
# Remove inherited permissions and grant access only to Administrators and SYSTEM
icacls "C:\Program Files\FREQSHIP-mini" /inheritance:r
icacls "C:\Program Files\FREQSHIP-mini" /grant:r "BUILTIN\Administrators:(OI)(CI)F"
icacls "C:\Program Files\FREQSHIP-mini" /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F"
icacls "C:\Program Files\FREQSHIP-mini" /grant:r "BUILTIN\Users:(OI)(CI)RX"