CVE-2025-69783

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-69783", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-17T13:54:12.332Z", "dateReserved": "2026-01-09T00:00:00.000Z", "datePublished": "2026-03-16T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-16T15:39:36.471Z"}, "descriptions": [{"lang": "en", "value": "A local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious executable to match a trusted process name (e.g., csrss.exe, edrsvc.exe, edrcon.exe). This allows unauthorized interaction with the OpenEDR kernel driver, granting access to privileged functionality such as configuration changes, process monitoring, and IOCTL communication that should be restricted to trusted components. While this issue alone does not directly grant SYSTEM privileges, it breaks OpenEDR's trust model and enables further exploitation leading to full local privilege escalation."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://scavengersecurity.com/posts/edr-as-rootkit-2/"}, {"url": "https://github.com/ComodoSecurity/openedr"}, {"url": "https://www.openedr.com/"}, {"url": "https://github.com/ComodoSecurity/openedr/issues/49"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-250", "lang": "en", "description": "CWE-250 Execution with Unnecessary Privileges"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-17T13:50:23.804624Z", "id": "CVE-2025-69783", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T13:54:12.332Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-69783", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-17T13:50:23.804624Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-250", "description": "CWE-250 Execution with Unnecessary Privileges"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T13:54:03.696Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://scavengersecurity.com/posts/edr-as-rootkit-2/"}, {"url": "https://github.com/ComodoSecurity/openedr"}, {"url": "https://www.openedr.com/"}, {"url": "https://github.com/ComodoSecurity/openedr/issues/49"}], "descriptions": [{"lang": "en", "value": "A local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious executable to match a trusted process name (e.g., csrss.exe, edrsvc.exe, edrcon.exe). This allows unauthorized interaction with the OpenEDR kernel driver, granting access to privileged functionality such as configuration changes, process monitoring, and IOCTL communication that should be restricted to trusted components. While this issue alone does not directly grant SYSTEM privileges, it breaks OpenEDR's trust model and enables further exploitation leading to full local privilege escalation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-16T15:39:36.471Z"}}}, "cveMetadata": {"cveId": "CVE-2025-69783", "state": "PUBLISHED", "dateUpdated": "2026-03-17T13:54:12.332Z", "dateReserved": "2026-01-09T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-16T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:xcitium:openedr:2.5.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "C2BE1711-EE54-4E5D-A6CD-40033932443C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious executable to match a trusted process name (e.g., csrss.exe, edrsvc.exe, edrcon.exe). This allows unauthorized interaction with the OpenEDR kernel driver, granting access to privileged functionality such as configuration changes, process monitoring, and IOCTL communication that should be restricted to trusted components. While this issue alone does not directly grant SYSTEM privileges, it breaks OpenEDR's trust model and enables further exploitation leading to full local privilege escalation."}, {"lang": "es", "value": "Un atacante local puede eludir el mecanismo de autodefensa 2.5.1.0 de OpenEDR al renombrar un ejecutable malicioso para que coincida con el nombre de un proceso de confianza (p. ej., 'csrss.exe', 'edrsvc.exe', 'edrcon.exe'). Esto permite la interacci\u00f3n no autorizada con el controlador de kernel de OpenEDR, otorgando acceso a funcionalidades privilegiadas como cambios de configuraci\u00f3n, monitoreo de procesos y comunicaci\u00f3n IOCTL que deber\u00eda estar restringida a componentes de confianza. Si bien este problema por s\u00ed solo no otorga directamente privilegios de SYSTEM, rompe el modelo de confianza de OpenEDR y permite una explotaci\u00f3n adicional que conduce a una escalada de privilegios local completa."}], "id": "CVE-2025-69783", "lastModified": "2026-06-17T10:00:52.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69783", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-17T13:50:23.804624Z", "version": "2.0.3"}}]}, "published": "2026-03-16T16:16:13.333", "references": [{"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/ComodoSecurity/openedr"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://github.com/ComodoSecurity/openedr/issues/49"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://scavengersecurity.com/posts/edr-as-rootkit-2/"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://www.openedr.com/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-250"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.5.1.0"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "openedr", "vendor": "comodosecurity"}], "analysis": {"en": {"generated_at": "2026-03-20T15:29:23.697892+00:00", "value": {"mitigation_remediation": ["Apply any available OpenEDR update or patch if released.", "If no update is available, revoke local user privileges that allow execution of new files and enforce strict controls on executable naming conventions.", "Monitor the system for processes bearing names of trusted components that are not legitimate and investigate promptly.", "If the vendor has not patched the issue, consider hardening the kernel driver access or disabling it for untrusted executables until a fix is available."], "summary": {"action": "Patch", "impact": "Local Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Affected system: Xcitium OpenEDR version 2.5.1.0 as identified by the CPE string cpe:2.3:a:xcitium:openedr:2.5.1.0:*:*:*:*:*:*.*", "description_and_impact": "The vulnerability permits a local attacker to bypass OpenEDR 2.5.1.0\u2019s self\u2011defense mechanism by renaming a malicious executable to a trusted process name such as csrss.exe, edrsvc.exe, or edrcon.exe. This trick enables the attacker to interact with the OpenEDR kernel driver and invoke privileged API calls\u2014including configuration changes, process monitoring, and IOCTL communication\u2014that are intended to be restricted to trusted components. Although this alone does not grant SYSTEM privileges, it breaks the trust model and can facilitate further exploitation that may lead to full local privilege escalation.", "risk_and_exploitability": "The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Attackers would need local access and the ability to place or rename a file on the system, which is a common privilege escalation scenario for a local threat actor. The risk is significant for environments relying on OpenEDR\u2019s self\u2011defense to enforce component trust boundaries."}}}}, "created": "2026-03-17T09:55:29.705706+00:00", "title": "OpenEDR Local Self\u2011Defense Bypass Leading to Privilege Escalation", "updated": "2026-03-23T14:00:54.530209+00:00", "vendors": ["comodosecurity", "comodosecurity$PRODUCT$openedr"]}