CVE-2025-69783
Last modified
CVE-2025-69783 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. A local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious executable to match a trusted process name (e.g., csrss.exe, edrsvc.exe, edrcon.exe). This allows unauthorized interaction with the OpenEDR kernel driver, granting access to privileged functionality such as configuration changes, process monitoring, and IOCTL communication that should be restricted to trusted components. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
A local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious executable to match a trusted process name (e.g., csrss.exe, edrsvc.exe, edrcon.exe). This allows unauthorized interaction with the OpenEDR kernel driver, granting access to privileged functionality such as configuration changes, process monitoring, and IOCTL communication that should be restricted to trusted components. While this issue alone does not directly grant SYSTEM privileges, it breaks OpenEDR's trust model and enables further exploitation leading to full local privilege escalation.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Xcitium | Openedr | 2.5.1.0 |
References
- https://github.com/ComodoSecurity/openedr/issues/49Issue Tracking, Third Party Advisory
- https://scavengersecurity.com/posts/edr-as-rootkit-2/Exploit, Third Party Advisory
- https://www.openedr.com/Product
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-69783?
How severe is CVE-2025-69783?
How do I fix CVE-2025-69783?
Are you affected by CVE-2025-69783?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST