Bypass Vulnerability in OpenEDR Self-Defense Mechanism by Comodo
CVE-2025-69783

7.8HIGH

Key Information:

Vendor

Comodo

Status
OpenEDR
Vendor
CVE Published:
16 March 2026

What is CVE-2025-69783?

A local attacker can circumvent the self-defense mechanism of OpenEDR version 2.5.1.0 by renaming a malicious executable to impersonate a trusted process such as csrss.exe, edrsvc.exe, or edrcon.exe. This manipulation can result in unauthorized access to the OpenEDR kernel driver, thereby allowing modifications to configurations, monitoring of processes, and IOCTL communication. Although this vulnerability does not directly confer SYSTEM privileges, it undermines the integrity of OpenEDR's trust model, opening pathways for further exploits that may facilitate complete local privilege escalation.

References

https://scavengersecurity.com/posts/edr-as-rootkit-2/
https://github.com/ComodoSecurity/openedr
https://www.openedr.com/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.