Fuji Electric FRENIC-Loader 4 arbitrary code execution flaw
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Deserialization vulnerability in FRENIC-Loader 4 allows local arbitrary code execution; update to v1.4.0.1.
Fuji Electric FRENIC-Loader 4 versions prior to 1.4.0.1 contain a deserialization of untrusted data vulnerability (CVE-2025-9365, CWE-502) that allows arbitrary code execution when an attacker-controlled file is imported through the application's import window. The vulnerability requires local access and user interaction but carries high severity with a CVSS v3.1 score of 7.8 and CVSS v4 score of 8.4. The product is deployed worldwide in commercial facilities infrastructure. FRENIC-Loader 4 is used in industrial control environments, making this a concern for organizations managing motor control systems. CISA reports no known public exploitation at this time and confirms the vulnerability is not remotely exploitable. Researchers at Trend Micro Zero Day Initiative disclosed the flaw responsibly to CISA.
Mentioned in this report
Detection guidance
FRENIC-Loader Spawning Shell or Script Interpreter
FRENIC-Loader process spawning a command shell, script host or LOLBin, which would indicate code execution after a malicious file import (CVE-2025-9365 deserialization). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FRENIC-Loader Spawning Shell or Script Interpreter
description: Detects a Fuji Electric FRENIC-Loader process spawning a command shell,
script host or common LOLBin. The engineering tool has no normal need to launch
these, so a child process is consistent with arbitrary code execution through deserialization
of an attacker-controlled import file (CVE-2025-9365). Matches the parent/child
relation, not a specific payload.
tags:
- attack.execution
- attack.defense-impairment
- attack.t1553.006
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: FRENIC
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
condition: selection_parent and selection_child
falsepositives:
- Vendor installer or updater launching cmd.exe for setup steps
- Engineers launching a help or script helper from within the tool
level: high
id: 762deeb6-54a4-5094-88d7-45228b91313f
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-02
FRENIC-Loader Outbound SMB Connection to Non-Private Address
FRENIC-Loader process connecting to SMB/NetBIOS ports on a non-RFC1918 host, which may indicate forced authentication via a UNC path in a crafted file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FRENIC-Loader Outbound SMB Connection to Non-Private Address
description: Detects a Fuji Electric FRENIC-Loader process making an SMB or NetBIOS
connection (445/139) to a non-private address. A crafted imported file could force
NTLM authentication to an attacker-controlled host. Engineering tools normally have
no reason to open SMB sessions to external hosts.
tags:
- attack.credential-access
- attack.t1187
logsource:
category: network_connection
product: windows
detection:
selection:
Image|contains: FRENIC
DestinationPort:
- 445
- 139
Initiated: 'true'
filter_private:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
condition: selection and not filter_private
falsepositives:
- Loader saving or opening project files on a file server reached over a routed public-range
address or VPN
level: medium
id: ec9a16f7-8f56-5692-9544-90c7fa315480
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-02
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-02
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs