Mitsubishi Electric ICONICS products vulnerable to local DoS via symlink
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Local attacker can destroy files via symlink attack in ICONICS and GENESIS products, causing denial of service.
CVE-2025-0921 is an information tampering vulnerability affecting multiple Mitsubishi Electric ICONICS Digital Solutions and Mitsubishi Electric products due to execution with unnecessary privileges. A local attacker can create a symbolic link from a file used as a write destination by affected services to an arbitrary target file, allowing the attacker to destroy that target file and cause denial of service if the file is necessary for PC operation.
Affected products include GENESIS64 (≤10.97.3), ICONICS Suite (≤10.97.3), MobileHMI (≤10.97.3), Hyper Historian (≤10.97.3), AnalytiX (≤10.97.3), IoTWorX (10.95), GENESIS32 (all versions), BizViz (all versions), GENESIS (11.00), and MC Works64 (all versions). Mitsubishi Electric is releasing fixed versions 10.98 or later for most products and 10.96 or later for IoTWorX. No fixes are planned for MC Works64, GENESIS32, and BizViz.
The vulnerability requires local access to the affected PC. CISA and the vendor recommend restricting administrator login, using firewall/VPN protections to block remote access, and restricting physical access to affected systems. Organizations without available patches should implement network segmentation and access controls as interim mitigations.
Mentioned in this report
Detection guidance
Symbolic Link or Junction Created Against ICONICS Paths via mklink
cmd.exe mklink referencing ICONICS/GENESIS64 paths, consistent with the CVE-2025-0921 symlink abuse of service write destinations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Symbolic Link or Junction Created Against ICONICS Paths via mklink
description: Detects mklink executed with a command line referencing ICONICS product
paths. CVE-2025-0921 abuses a symlink from a file that ICONICS/Mitsubishi services
write to, pointing at an arbitrary target, so the privileged service overwrites
or destroys that target (local DoS). Generalises on mklink plus the product path,
not on any specific target file.
tags:
- attack.impact
- attack.t1499.004
- attack.privilege-escalation
- attack.t1548.004
logsource:
category: process_creation
product: windows
detection:
selection_mklink:
CommandLine|contains: mklink
selection_product:
CommandLine|contains: ICONICS
condition: selection_mklink and selection_product
falsepositives:
- Administrators relocating ICONICS log or data folders with symlinks during a migration
- Engineering or deployment scripts that link ICONICS project directories to another
volume
level: high
id: b5e419e4-b751-58a0-a451-f854c753cce8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04
Junction or Hard Link Created Pointing at Windows System Directories via mklink
mklink /J or /H whose command line references Windows system directories, a primitive for making a privileged service destroy critical files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Junction or Hard Link Created Pointing at Windows System Directories via mklink
description: Detects mklink creating a junction (/J) or hard link (/H) where the command
line references Windows system directories. Link-redirection of a privileged service's
write destination onto OS files is the primitive behind CVE-2025-0921 style local
denial of service, and is usable by unprivileged users because junctions and hard
links need no admin rights.
tags:
- attack.impact
- attack.t1499.004
- attack.privilege-escalation
- attack.t1548.004
logsource:
category: process_creation
product: windows
detection:
selection_mklink:
CommandLine|contains|all:
- mklink
- ' /'
selection_type:
CommandLine|contains:
- ' /J'
- ' /H'
selection_target:
CommandLine|contains:
- \Windows\System32
- \Windows\SysWOW64
- \Windows\Boot
- \Windows\WinSxS
- \Windows\win.ini
condition: selection_mklink and selection_type and selection_target
falsepositives:
- Installers or servicing scripts that create links into WinSxS or System32 for compatibility
shims
- Developers testing link behaviour on lab machines
level: medium
id: 13730585-3722-5a42-923f-4ad319960898
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04
PowerShell Creating Symlink, Junction or Hard Link to ICONICS or System Paths
PowerShell New-Item creating SymbolicLink/Junction/HardLink referencing ICONICS or Windows system directories. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PowerShell Creating Symlink, Junction or Hard Link to ICONICS or System Paths
description: Detects PowerShell New-Item with -ItemType SymbolicLink, Junction or
HardLink where the command line references ICONICS paths or Windows system directories.
This is a scripted equivalent of the symlink redirection used to exploit CVE-2025-0921,
where a service writing to a link destroys the target file.
tags:
- attack.impact
- attack.t1499.004
- attack.privilege-escalation
- attack.t1548.004
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \powershell.exe
- \pwsh.exe
selection_cmd:
CommandLine|contains|all:
- New-Item
- ItemType
selection_linktype:
CommandLine|contains:
- SymbolicLink
- Junction
- HardLink
selection_target:
CommandLine|contains:
- ICONICS
- \Windows\System32
- \Windows\SysWOW64
condition: selection_img and selection_cmd and selection_linktype and selection_target
falsepositives:
- Administrators scripting storage relocation of ICONICS data directories
- Software provisioning scripts that link into System32 paths
level: medium
id: de31ceae-f0e7-5d2f-bf40-e6e1a2abb084
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs