# Fuji Electric FRENIC-Loader 4 arbitrary code execution flaw

Published: 2025-09-02 · Severity: elevated · Sectors: infrastructure, manufacturing
Canonical: https://vorant.io/reports/a57df467-62ba-55cb-aa6b-7b7f209e0de4/fuji-electric-frenic-loader-4-arbitrary-code-execution-flaw

> Deserialization vulnerability in FRENIC-Loader 4 allows local arbitrary code execution; update to v1.4.0.1.

Fuji Electric FRENIC-Loader 4 versions prior to 1.4.0.1 contain a deserialization of untrusted data vulnerability (CVE-2025-9365, CWE-502) that allows arbitrary code execution when an attacker-controlled file is imported through the application's import window. The vulnerability requires local access and user interaction but carries high severity with a CVSS v3.1 score of 7.8 and CVSS v4 score of 8.4. The product is deployed worldwide in commercial facilities infrastructure. FRENIC-Loader 4 is used in industrial control environments, making this a concern for organizations managing motor control systems. CISA reports no known public exploitation at this time and confirms the vulnerability is not remotely exploitable. Researchers at Trend Micro Zero Day Initiative disclosed the flaw responsibly to CISA.

## Mentioned in this report

- Vulnerabilities: CVE-2025-9365

## Detection guidance (public sample)

### FRENIC-Loader Spawning Shell or Script Interpreter

ATT&CK: T1553.006

FRENIC-Loader process spawning a command shell, script host or LOLBin, which would indicate code execution after a malicious file import (CVE-2025-9365 deserialization). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FRENIC-Loader Spawning Shell or Script Interpreter
description: Detects a Fuji Electric FRENIC-Loader process spawning a command shell,
  script host or common LOLBin. The engineering tool has no normal need to launch
  these, so a child process is consistent with arbitrary code execution through deserialization
  of an attacker-controlled import file (CVE-2025-9365). Matches the parent/child
  relation, not a specific payload.
tags:
- attack.execution
- attack.defense-impairment
- attack.t1553.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: FRENIC
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  condition: selection_parent and selection_child
falsepositives:
- Vendor installer or updater launching cmd.exe for setup steps
- Engineers launching a help or script helper from within the tool
level: high
id: 762deeb6-54a4-5094-88d7-45228b91313f
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-02
```

### FRENIC-Loader Outbound SMB Connection to Non-Private Address

ATT&CK: T1187

FRENIC-Loader process connecting to SMB/NetBIOS ports on a non-RFC1918 host, which may indicate forced authentication via a UNC path in a crafted file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FRENIC-Loader Outbound SMB Connection to Non-Private Address
description: Detects a Fuji Electric FRENIC-Loader process making an SMB or NetBIOS
  connection (445/139) to a non-private address. A crafted imported file could force
  NTLM authentication to an attacker-controlled host. Engineering tools normally have
  no reason to open SMB sessions to external hosts.
tags:
- attack.credential-access
- attack.t1187
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains: FRENIC
    DestinationPort:
    - 445
    - 139
    Initiated: 'true'
  filter_private:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
  condition: selection and not filter_private
falsepositives:
- Loader saving or opening project files on a file server reached over a routed public-range
  address or VPN
level: medium
id: ec9a16f7-8f56-5692-9544-90c7fa315480
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-02
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a57df467-62ba-55cb-aa6b-7b7f209e0de4/fuji-electric-frenic-loader-4-arbitrary-code-execution-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup