PT-2026-25768 · Xcitium · Openedr

Publicado 2026-03-16 · Atualizado 2026-03-17 · CVE-2025-69784

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEDR version 2.5.1.0

Description A local, non-privileged attacker can exploit a vulnerable IOCTL interface exposed by the OpenEDR kernel driver to modify the DLL injection path used by the product. By redirecting this path to a user-writable location, an attacker can cause OpenEDR to load a malicious DLL into high-privilege processes. This results in arbitrary code execution with SYSTEM privileges, leading to a full system compromise. An IOCTL (Input/Output Control) interface allows applications to communicate with device drivers. In this case, the vulnerable IOCTL interface allows modification of the DLL injection path.

Recommendations Update to a newer version of OpenEDR that addresses this vulnerability.

Exploit

Correção

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-427

Identificadores relacionados

CVE-2025-69784

Produtos afetados

Openedr

Referências · 8

• 🔥 https://gist.github.com/ikerl/c3ec81f12ded44c2e0ae2dfdacb562ba · Exploit
• 🔥 https://scavengersecurity.com/posts/edr-as-rootkit-2 · Exploit
• https://github.com/ComodoSecurity/openedr/issues/49 · Nota
• https://github.com/ComodoSecurity/openedr · Nota
• https://openedr.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-69784 · Nota de Segurança
• https://twitter.com/CVEnew/status/2033755376722620629 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2033634362076631313 · Publicação no Twitter