{"id":"CVE-2025-10314","aliases":["EUVD-2025-206872","GHSA-m3h9-rrjj-r246"],"status":"published","title":"Malicious Code Execution Vulnerability in Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for Windows","description":"Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to execute arbitrary code with system privileges by replacing service executable files (EXE) or DLLs in the installation directory with specially crafted files. As a result, the attacker may be able to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a Denial of Service (DoS) condition on the affected system.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00164,"percentile":0.05713,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-276"],"published":"2026-02-05T03:07:55Z","modified":"2026-06-17T08:28:06Z","products":[{"vendor":"mitsubishi electric corporation","product":"freqship-mini for windows"}],"references":[{"url":"https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-019_en.pdf","tags":["vendor-advisory"]},{"url":"https://jvn.jp/jp/JVN64883963/","tags":["government-resource"]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-034-01","tags":["government-resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10314"},{"url":"https://jvn.jp/jp/JVN64883963"},{"url":"https://github.com/advisories/GHSA-m3h9-rrjj-r246"}],"sources":{"cve":[{"id":"CVE-2025-10314","title":"Malicious Code Execution Vulnerability in Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for Windows","description":"Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to execute arbitrary code with system privileges by replacing service executable files (EXE) or DLLs in the installation directory with specially crafted files. As a result, the attacker may be able to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a Denial of Service (DoS) condition on the affected system.","status":"published","published":"2026-02-05T03:07:55.753Z","modified":"2026-02-05T14:42:20.58Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:32:30.643267Z"}],"euvd":[{"id":"EUVD-2025-206872","description":"Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to execute arbitrary code with system privileges by replacing service executable files (EXE) or DLLs in the installation directory with specially crafted files. As a result, the attacker may be able to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a Denial of Service (DoS) condition on the affected system.","status":"published","published":"2026-02-05T03:07:55Z","modified":"2026-02-05T14:42:20Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:43.720683Z"}],"ghsa":[{"id":"GHSA-m3h9-rrjj-r246","title":"Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for...","description":"Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to execute arbitrary code with system privileges by replacing service executable files (EXE) or DLLs in the installation directory with specially crafted files. As a result, the attacker may be able to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a Denial of Service (DoS) condition on the affected system.","status":"published","published":"2026-02-05T03:30:17Z","modified":"2026-02-05T03:30:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T15:06:03.410025Z"}],"nvd":[{"id":"CVE-2025-10314","description":"Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to execute arbitrary code with system privileges by replacing service executable files (EXE) or DLLs in the installation directory with specially crafted files. As a result, the attacker may be able to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a Denial of Service (DoS) condition on the affected system.","status":"published","published":"2026-02-05T03:15:51.24Z","modified":"2026-06-17T08:28:06.09Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:11:59.832225Z"}]}}