PT-2026-25768 · Xcitium · Openedr

Published 2026-03-16 · Updated 2026-03-17 · CVE-2025-69784

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEDR version 2.5.1.0

Description A local, non-privileged attacker can exploit a vulnerable IOCTL interface exposed by the OpenEDR kernel driver to modify the DLL injection path used by the product. By redirecting this path to a user-writable location, an attacker can cause OpenEDR to load a malicious DLL into high-privilege processes. This results in arbitrary code execution with SYSTEM privileges, leading to a full system compromise. An IOCTL (Input/Output Control) interface allows applications to communicate with device drivers. In this case, the vulnerable IOCTL interface allows modification of the DLL injection path.

Recommendations Update to a newer version of OpenEDR that addresses this vulnerability.

Exploit

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-69784

Affected Products

Openedr

References · 8

• 🔥 https://gist.github.com/ikerl/c3ec81f12ded44c2e0ae2dfdacb562ba · Exploit
• 🔥 https://scavengersecurity.com/posts/edr-as-rootkit-2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-69784 · Security Note
• https://github.com/ComodoSecurity/openedr/issues/49 · Note
• https://github.com/ComodoSecurity/openedr · Note
• https://openedr.com · Note
• https://twitter.com/CVEnew/status/2033755376722620629 · Twitter Post
• https://twitter.com/TheHackerWire/status/2033634362076631313 · Twitter Post