A critical local privilege escalation vulnerability in the OpenEDR 2.5.1.0 kernel driver allows unprivileged attackers to gain full SYSTEM control over the affected host.

This vulnerability involves an insecure IOCTL interface that allows a local, non-privileged user to modify the DLL injection path. By redirecting this path to a malicious, user-writable location, an attacker can force high-privilege processes to load unauthorized code.

The ability for a local attacker to escalate privileges to SYSTEM level represents a total compromise of the affected system. Given the CVSS score of 8.8, this vulnerability poses a significant risk to organizational security, as it allows for the complete bypass of security controls, data exfiltration, and persistent access by malicious actors.

Immediate Action: Restrict local access to the system and monitor for unauthorized modification of kernel driver configurations. Since a specific patch version is currently unknown, contact the vendor for guidance on disabling the vulnerable driver or implementing provided workarounds.

Proactive Monitoring: Monitor system logs for unusual process execution patterns and unauthorized attempts to interact with the OpenEDR kernel driver interface.

Compensating Controls: Ensure that directory permissions are strictly enforced to prevent non-privileged users from creating or modifying files in sensitive, system-level paths that could be utilized for DLL hijacking.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up by Scavenger Security and the associated GitHub Gist.

The severity of this vulnerability necessitates immediate attention, as it provides a direct path to total system compromise for local attackers. Administrators should prioritize identifying all instances of OpenEDR 2.5.1.0 within the environment and implement strict access controls while awaiting official vendor remediation instructions.