PT-2026-25767 · Xcitium · Openedr

Published 2026-03-16 · Updated 2026-03-17 · CVE-2025-69783

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEDR version 2.5.1.0

Description A local attacker can circumvent the self-defense mechanism in OpenEDR by renaming a malicious executable to match a trusted process name, such as csrss.exe, edrsvc.exe, or edrcon.exe. This allows unauthorized interaction with the OpenEDR kernel driver, granting access to privileged functionality including configuration changes, process monitoring, and IOCTL communication. While this issue does not directly grant SYSTEM privileges, it compromises OpenEDR’s trust model and enables further exploitation leading to local privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2025-69783

Affected Products

Openedr

References · 7

• 🔥 https://scavengersecurity.com/posts/edr-as-rootkit-2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-69783 · Security Note
• https://github.com/ComodoSecurity/openedr · Note
• https://github.com/ComodoSecurity/openedr/issues/49 · Note
• https://openedr.com · Note
• https://twitter.com/VulmonFeeds/status/2033648650790855127 · Twitter Post
• https://twitter.com/CVEnew/status/2033755375778816369 · Twitter Post