Privileged File System Vulnerability Present in a SCADA Syst...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/
• Blog Title: Privileged File System Vulnerability Present in a SCADA System
• Suggested Section: Windows Local Privilege Escalation -> Arbitrary File Write/Overwrite to SYSTEM (or a subsection on Windows symlink/reparse point/Object Manager link abuse for privileged file operations)

🎯 Content Summary

Post title: Privileged File System Vulnerability Present in a SCADA System (Unit 42, published January 30, 2026)

What the post is about
Unit 42 analyzes CVE-2025-0921 (CVSS 6.5 Medium) in Mitsubishi Electric Iconics Digital Solutions GENESIS64 / Iconics Suite (SCADA) for Microsoft Windows versions 10.97.2 and earlier. The bug is categorized as execution with unnecessary privileges across multiple services and is demonstrated via a ...

🔧 Technical Details

When a privileged Windows process writes to a path influenced by a low-privilege user (e.g., a configurable log destination stored in a writable config file like C:\ProgramData...*.ini), the attacker can convert that write into an arbitrary file overwrite by redirecting the destination using Windows filesystem/object-manager primitives (e.g., Object Manager symbolic links combined with NTFS mount points to create file symlinks without admin). Triggering normal program behavior (such as writing an SMS log during an alert) causes the privileged process to overwrite an attacker-chosen protected target. A reliable DoS variant is redirecting the write into a boot-critical driver path (e.g., placing/corrupting C:\Windows\System32\cng.sys so Windows attempts to load it on boot), resulting in a boot failure/repair loop. Verification can be done by inspecting the overwritten file contents (e.g., with CFF Explorer) to confirm it now contains log text rather than a val...

🤖 Agent Actions

Updated windows-hardening/windows-local-privilege-escalation/README.md by restoring the full page and adding a new section detailing abuse of privileged log/backup paths via Object Manager symlinks and NTFS mount points to convert privileged writes into arbitrary file overwrites/boot DoS (including CreateMountPoint/CreateSymlink steps and cng.sys corruption flow). Expanded references with the Unit 42 SCADA blog, CreateSymlink tooling docs, and Forshaw’s symlink research.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/

Content Categories: Based on the analysis, this content was categorized under "Windows Local Privilege Escalation -> Arbitrary File Write/Overwrite to SYSTEM (or a subsection on Windows symlink/reparse point/Object Manager link abuse for privileged file operations)".

Repository Maintenance:

• MD Files Formatting: 944 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0