Critical Vulnerability in Mitsubishi Electric's FREQSHIP-mini: CVE-2025-10314
Executive Summary
In February 2026, Mitsubishi Electric disclosed a critical vulnerability (CVE-2025-10314) in its FREQSHIP-mini for Windows software, versions 8.0.0 to 8.0.2. The flaw arises from incorrect default permissions during installation, allowing local attackers to replace service executables or DLLs with malicious files. Exploiting this vulnerability enables arbitrary code execution with SYSTEM privileges, potentially leading to unauthorized access, data manipulation, or denial-of-service conditions. This vulnerability is particularly concerning for critical infrastructure sectors, including manufacturing and energy, where FREQSHIP-mini is commonly deployed. Organizations are urged to update to version 8.1.0 or later and implement recommended mitigation measures to prevent exploitation. (jvn.jp)
Why This Matters Now
The disclosure of CVE-2025-10314 highlights the ongoing risks associated with improper file permission settings in critical infrastructure software. As attackers increasingly target such vulnerabilities to gain elevated privileges, it is imperative for organizations to promptly apply patches and review security configurations to safeguard against potential exploits.
Attack Path Analysis
An attacker exploited incorrect default permissions in Mitsubishi Electric FREQSHIP-mini for Windows to execute arbitrary code with system privileges. This allowed them to escalate their privileges, potentially leading to unauthorized access, modification, or destruction of information, and causing a denial-of-service condition on the affected system.
Kill Chain Progression
Initial Compromise
Description
The attacker exploited incorrect default permissions in Mitsubishi Electric FREQSHIP-mini for Windows to execute arbitrary code with system privileges.
Related CVEs
CVE-2025-10314
CVSS 8.8Incorrect default permissions in Mitsubishi Electric FREQSHIP-mini for Windows allow local attackers to execute arbitrary code with SYSTEM privileges.
Affected Products:
Mitsubishi Electric FREQSHIP-mini for Windows – 8.0.0, 8.0.1, 8.0.2
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Hijack Execution Flow: Services File Permissions Weakness
Windows File and Directory Permissions Modification
Abuse Elevation Control Mechanism
Hijack Execution Flow: Executable Installer File Permissions Weakness
Hijack Execution Flow: Services Registry Permissions Weakness
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 – Least Privilege
Control ID: AC-6
PCI DSS 4.0 – Limit Access to System Components and Cardholder Data
Control ID: 7.1.2
NYDFS 23 NYCRR 500 – Access Privileges
Control ID: 500.07
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA Zero Trust Maturity Model 2.0 – Enforce Least Privilege Access
Control ID: Identity Pillar: Access Control
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Utilities
UPS shutdown software privilege escalation threatens critical power infrastructure operations, enabling system compromise and potential service disruptions across electrical grid systems.
Critical Manufacturing
Mitsubishi UPS systems in manufacturing environments face privilege escalation risks, allowing attackers to disrupt production operations and compromise industrial control systems.
Health Care / Life Sciences
Healthcare facilities using affected UPS systems risk unauthorized access to critical medical equipment power management, potentially compromising patient safety and data.
Government Administration
Government facilities relying on Mitsubishi UPS infrastructure face privilege escalation vulnerabilities that could compromise sensitive systems and continuity of operations.
Sources
- Mitsubishi Electric FREQSHIP-mini for Windowshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-034-01Verified
- JVN#64883963: Improper file access permission settings in Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for Windowshttps://jvn.jp/en/jp/JVN64883963/Verified
- JVNDB-2026-000017 - JVN iPediahttps://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000017.htmlVerified
- Mitsubishi Electric FREQSHIP-mini for Windows - IT Security Newshttps://www.itsecuritynews.info/mitsubishi-electric-freqship-mini-for-windows/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have limited the attacker's ability to escalate privileges and move laterally within the network, thereby reducing the potential blast radius.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to execute arbitrary code with system privileges may have been constrained, limiting unauthorized access to sensitive information and system resources.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to access sensitive information and system resources would likely have been limited, reducing the scope of unauthorized activities.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally within the network would likely have been constrained, limiting the spread of the attack.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish and maintain command and control channels would likely have been restricted, reducing remote control over compromised systems.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data would likely have been limited, reducing the risk of data loss.
The attacker's ability to cause a denial-of-service condition would likely have been constrained, reducing the impact on system availability.
Impact at a Glance
Affected Business Functions
- System Monitoring
- Power Management
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of system configuration data and operational logs.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce least privilege access and prevent unauthorized lateral movement.
- • Deploy Inline IPS (Suricata) to detect and prevent exploitation attempts targeting known vulnerabilities.
- • Utilize Threat Detection & Anomaly Response systems to identify and respond to suspicious activities promptly.
- • Apply Restrict File and Directory Permissions to limit access to critical system files and directories.
- • Regularly update and patch software to remediate known vulnerabilities and reduce the attack surface.
