Mitsubishi ICONICS Shortcut Following allows local privilege escalation
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CVE-2025-7376 in Mitsubishi ICONICS products allows local attackers to overwrite arbitrary files via symbolic links, causing denial of service.
CISA has published an advisory on CVE-2025-7376, a Windows Shortcut Following (.LNK) vulnerability affecting multiple Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions products. A local attacker with low privilege can exploit this flaw by creating a symbolic link to cause elevated processes to write to arbitrary files on the filesystem, potentially destroying critical files and causing denial of service on affected systems. The vulnerability impacts GENESIS64 (≤10.97.3), ICONICS Suite (≤10.97.3), MobileHMI (≤10.97.3), Hyper Historian (≤10.97.3), AnalytiX (≤10.97.3), IoTWorX (10.95), MC Works 64 (all versions), and GENESIS (11.00). Mitsubishi Electric is releasing patched versions: 10.98 or later for most affected products, 10.96 or later for IoTWorX, and 11.01 or later for GENESIS. No patch is planned for MC Works 64. The advisory does not indicate active exploitation in the wild.
Mentioned in this report
Detection guidance
Symbolic Link or Junction Created Targeting ICONICS Directories
Detects mklink or PowerShell New-Item creating a symlink or junction with ICONICS in the command line, the primitive used to abuse CVE-2025-7376 shortcut following for local privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Symbolic Link or Junction Created Targeting ICONICS Directories
description: Detects creation of symbolic links or junctions via mklink or PowerShell
New-Item where the command line references ICONICS paths. This is the primitive
used to redirect writes by elevated ICONICS/Mitsubishi processes to arbitrary files
(CVE-2025-7376 shortcut following). Generalises on link-creation tooling plus the
product name, not on specific file names.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
category: process_creation
product: windows
detection:
selection_mklink:
Image|endswith: \cmd.exe
CommandLine|contains|all:
- mklink
- ICONICS
selection_ps_base:
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains|all:
- New-Item
- ICONICS
selection_ps_type:
CommandLine|contains:
- SymbolicLink
- Junction
condition: selection_mklink or (selection_ps_base and selection_ps_type)
falsepositives:
- Administrators relocating ICONICS data or log folders with junctions during installation
or migration
- Software deployment scripts that set up ICONICS directory links
level: medium
id: f332bea3-334b-5a1f-b05b-6d383077becf
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-01
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs