# Mitsubishi ICONICS Shortcut Following allows local privilege escalation

Published: 2026-04-08 · Severity: routine · Sectors: manufacturing, infrastructure
Canonical: https://vorant.io/reports/e2597d37-094a-5d24-b221-11481fc426eb/mitsubishi-iconics-shortcut-following-allows-local-privilege-escalation

> CVE-2025-7376 in Mitsubishi ICONICS products allows local attackers to overwrite arbitrary files via symbolic links, causing denial of service.

CISA has published an advisory on CVE-2025-7376, a Windows Shortcut Following (.LNK) vulnerability affecting multiple Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions products. A local attacker with low privilege can exploit this flaw by creating a symbolic link to cause elevated processes to write to arbitrary files on the filesystem, potentially destroying critical files and causing denial of service on affected systems. The vulnerability impacts GENESIS64 (≤10.97.3), ICONICS Suite (≤10.97.3), MobileHMI (≤10.97.3), Hyper Historian (≤10.97.3), AnalytiX (≤10.97.3), IoTWorX (10.95), MC Works 64 (all versions), and GENESIS (11.00). Mitsubishi Electric is releasing patched versions: 10.98 or later for most affected products, 10.96 or later for IoTWorX, and 11.01 or later for GENESIS. No patch is planned for MC Works 64. The advisory does not indicate active exploitation in the wild.

## Mentioned in this report

- Vulnerabilities: CVE-2025-7376

## Detection guidance (public sample)

### Symbolic Link or Junction Created Targeting ICONICS Directories

ATT&CK: T1068

Detects mklink or PowerShell New-Item creating a symlink or junction with ICONICS in the command line, the primitive used to abuse CVE-2025-7376 shortcut following for local privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Symbolic Link or Junction Created Targeting ICONICS Directories
description: Detects creation of symbolic links or junctions via mklink or PowerShell
  New-Item where the command line references ICONICS paths. This is the primitive
  used to redirect writes by elevated ICONICS/Mitsubishi processes to arbitrary files
  (CVE-2025-7376 shortcut following). Generalises on link-creation tooling plus the
  product name, not on specific file names.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_mklink:
    Image|endswith: \cmd.exe
    CommandLine|contains|all:
    - mklink
    - ICONICS
  selection_ps_base:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains|all:
    - New-Item
    - ICONICS
  selection_ps_type:
    CommandLine|contains:
    - SymbolicLink
    - Junction
  condition: selection_mklink or (selection_ps_base and selection_ps_type)
falsepositives:
- Administrators relocating ICONICS data or log folders with junctions during installation
  or migration
- Software deployment scripts that set up ICONICS directory links
level: medium
id: f332bea3-334b-5a1f-b05b-6d383077becf
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-01
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e2597d37-094a-5d24-b221-11481fc426eb/mitsubishi-iconics-shortcut-following-allows-local-privilege-escalation.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup