# Mitsubishi Electric ICONICS products vulnerable to local DoS via symlink

Published: 2026-04-15 · Severity: routine · Sectors: manufacturing, infrastructure
Canonical: https://vorant.io/reports/d22abaa2-bc78-52ce-8224-a77e1d8b34f8/mitsubishi-electric-iconics-products-vulnerable-to-local-dos-via-symlink

> Local attacker can destroy files via symlink attack in ICONICS and GENESIS products, causing denial of service.

CVE-2025-0921 is an information tampering vulnerability affecting multiple Mitsubishi Electric ICONICS Digital Solutions and Mitsubishi Electric products due to execution with unnecessary privileges. A local attacker can create a symbolic link from a file used as a write destination by affected services to an arbitrary target file, allowing the attacker to destroy that target file and cause denial of service if the file is necessary for PC operation.

Affected products include GENESIS64 (≤10.97.3), ICONICS Suite (≤10.97.3), MobileHMI (≤10.97.3), Hyper Historian (≤10.97.3), AnalytiX (≤10.97.3), IoTWorX (10.95), GENESIS32 (all versions), BizViz (all versions), GENESIS (11.00), and MC Works64 (all versions). Mitsubishi Electric is releasing fixed versions 10.98 or later for most products and 10.96 or later for IoTWorX. No fixes are planned for MC Works64, GENESIS32, and BizViz.

The vulnerability requires local access to the affected PC. CISA and the vendor recommend restricting administrator login, using firewall/VPN protections to block remote access, and restricting physical access to affected systems. Organizations without available patches should implement network segmentation and access controls as interim mitigations.

## Mentioned in this report

- Vulnerabilities: CVE-2025-0921

## Detection guidance (public sample)

### Symbolic Link or Junction Created Against ICONICS Paths via mklink

ATT&CK: T1499.004

cmd.exe mklink referencing ICONICS/GENESIS64 paths, consistent with the CVE-2025-0921 symlink abuse of service write destinations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Symbolic Link or Junction Created Against ICONICS Paths via mklink
description: Detects mklink executed with a command line referencing ICONICS product
  paths. CVE-2025-0921 abuses a symlink from a file that ICONICS/Mitsubishi services
  write to, pointing at an arbitrary target, so the privileged service overwrites
  or destroys that target (local DoS). Generalises on mklink plus the product path,
  not on any specific target file.
tags:
- attack.impact
- attack.t1499.004
- attack.privilege-escalation
- attack.t1548.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_mklink:
    CommandLine|contains: mklink
  selection_product:
    CommandLine|contains: ICONICS
  condition: selection_mklink and selection_product
falsepositives:
- Administrators relocating ICONICS log or data folders with symlinks during a migration
- Engineering or deployment scripts that link ICONICS project directories to another
  volume
level: high
id: b5e419e4-b751-58a0-a451-f854c753cce8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04
```

### Junction or Hard Link Created Pointing at Windows System Directories via mklink

ATT&CK: T1499.004

mklink /J or /H whose command line references Windows system directories, a primitive for making a privileged service destroy critical files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Junction or Hard Link Created Pointing at Windows System Directories via mklink
description: Detects mklink creating a junction (/J) or hard link (/H) where the command
  line references Windows system directories. Link-redirection of a privileged service's
  write destination onto OS files is the primitive behind CVE-2025-0921 style local
  denial of service, and is usable by unprivileged users because junctions and hard
  links need no admin rights.
tags:
- attack.impact
- attack.t1499.004
- attack.privilege-escalation
- attack.t1548.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_mklink:
    CommandLine|contains|all:
    - mklink
    - ' /'
  selection_type:
    CommandLine|contains:
    - ' /J'
    - ' /H'
  selection_target:
    CommandLine|contains:
    - \Windows\System32
    - \Windows\SysWOW64
    - \Windows\Boot
    - \Windows\WinSxS
    - \Windows\win.ini
  condition: selection_mklink and selection_type and selection_target
falsepositives:
- Installers or servicing scripts that create links into WinSxS or System32 for compatibility
  shims
- Developers testing link behaviour on lab machines
level: medium
id: 13730585-3722-5a42-923f-4ad319960898
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04
```

### PowerShell Creating Symlink, Junction or Hard Link to ICONICS or System Paths

ATT&CK: T1499.004

PowerShell New-Item creating SymbolicLink/Junction/HardLink referencing ICONICS or Windows system directories. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PowerShell Creating Symlink, Junction or Hard Link to ICONICS or System Paths
description: Detects PowerShell New-Item with -ItemType SymbolicLink, Junction or
  HardLink where the command line references ICONICS paths or Windows system directories.
  This is a scripted equivalent of the symlink redirection used to exploit CVE-2025-0921,
  where a service writing to a link destroys the target file.
tags:
- attack.impact
- attack.t1499.004
- attack.privilege-escalation
- attack.t1548.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_cmd:
    CommandLine|contains|all:
    - New-Item
    - ItemType
  selection_linktype:
    CommandLine|contains:
    - SymbolicLink
    - Junction
    - HardLink
  selection_target:
    CommandLine|contains:
    - ICONICS
    - \Windows\System32
    - \Windows\SysWOW64
  condition: selection_img and selection_cmd and selection_linktype and selection_target
falsepositives:
- Administrators scripting storage relocation of ICONICS data directories
- Software provisioning scripts that link into System32 paths
level: medium
id: de31ceae-f0e7-5d2f-bf40-e6e1a2abb084
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d22abaa2-bc78-52ce-8224-a77e1d8b34f8/mitsubishi-electric-iconics-products-vulnerable-to-local-dos-via-symlink.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup