CVE-2025-10314

High

Published: 05 February 2026

Published

05 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0001 0.8th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-10314 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Services File Permissions Weakness (T1574.010); ranked at the 0.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-5 (Access Restrictions for Change) and CM-6 (Configuration Settings).

Threat & Defense at a Glance

What attackers do: exploitation maps to Services File Permissions Weakness (T1574.010) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

CM-6 Configuration Settings good match

prevent

Enforces secure configuration settings including restrictive default permissions on the installation directory to prevent low-privileged local attackers from replacing service EXEs or DLLs.

CM-5 Access Restrictions for Change good match

prevent

Restricts access to changes for configuration-controlled items like installation directory files, blocking unauthorized modifications by local attackers.

SC-34 Non-modifiable Executable Programs good match

prevent

Prevents execution of modifiable executable programs such as replaced service EXEs and DLLs, stopping privilege escalation from tampered files.

MITRE ATT&CK Enterprise TechniquesAI

T1574.010 Services File Permissions Weakness Stealth

Adversaries may execute their own malicious payloads by hijacking the binaries used by services.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Weak default permissions on service EXE/DLL files directly enable binary replacement for privilege escalation to SYSTEM via hijacking service execution flow.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to execute arbitrary code with system privileges by replacing service executable files (EXE) or DLLs in the installation directory with specially…

crafted files. As a result, the attacker may be able to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a Denial of Service (DoS) condition on the affected system.

Deeper analysisAI

CVE-2025-10314 is an Incorrect Default Permissions vulnerability (CWE-276) affecting Mitsubishi Electric Corporation's FREQSHIP-mini for Windows software in versions 8.0.0 through 8.0.2. The flaw arises from inadequate permissions on the installation directory, enabling unauthorized modification of critical files.

A local attacker with low privileges (PR:L) can exploit this vulnerability by replacing service executable (EXE) or DLL files in the installation directory with specially crafted malicious versions. This allows execution of arbitrary code with system privileges, potentially enabling the attacker to disclose, tamper with, delete, or destroy information stored on the affected PC, or induce a Denial of Service (DoS) condition. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting high impact due to the privilege escalation and changed scope.

Advisories from JVN (https://jvn.jp/jp/JVN64883963/), CISA (https://www.cisa.gov/news-events/ics-advisories/icsa-26-034-01), and Mitsubishi Electric (https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-019_en.pdf) provide details on mitigation and patching guidance for this issue.