CVE-2025-69783Disclosure(xcitium / openedr)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious executable to match a trusted process name (e.g., csrss.exe, edrsvc.exe, edrcon.exe). This allows unauthorized interaction with the OpenEDR kernel driver, granting access to privileged functionality such as configuration changes, process monitoring, and IOCTL communication that should be restricted to trusted components. While this issue alone does not directly grant SYSTEM privileges, it breaks OpenEDR's trust model and enables further exploitation leading to full local privilege escalation.

xcitium CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://scavengersecurity.com/posts/edr-as-rootkit-2/

Vendor / third-party advisories

https://github.com/ComodoSecurity/openedr/issues/49

Other references

Weakness type (CWE)

CWE-250

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openedr

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-03-16); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

xcitium

Products

openedr

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

CVE@CVEnew205d
Disclosure
CVE-2025-69783 A local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious executable to match a trusted process name (e.g., csrss.exe, edrsvc.exe, … https://www.cve.org/CVERecord?id=CVE-2025-69783
Post summary
The entry discloses that CVE-2025-69783 allows a local attacker to bypass OpenEDR’s self‑defense by spoofing trusted process names. No PoC, exploit tool, active exploitation claims, or patch information are provided.
00000188
56.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds205d
Disclosure
CVE-2025-69783 OpenEDR 2.5.1.0 Local Privilege Escalation via Process Name Spoofing https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-69783
Post summary
A new local privilege escalation vulnerability (CVE‑2025‑69783) in OpenEDR 2.5.1.0 via process name spoofing is disclosed, with no exploit, patch, or active exploitation details provided.
0000082
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	xcitium	openedr	2.5.1.0	-	-

Explore more

Back to dashboard xcitium CVEs openedr vulnerabilities