Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2025-8069

Local Privilege Escalation Vulnerability in AWS Client VPN Windows Client

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
AMZN

Description

During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL configuration file. As a result, a non-admin user could place arbitrary code in the configuration file. If an admin user starts the AWS Client VPN client installation process, that code could be executed with root-level privileges. This issue does not affect Linux or Mac devices. We recommend users discontinue any new installations of AWS Client VPN on Windows prior to version 5.2.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

AWS Client VPN

Default version status: unaffected

  • 4.1.0affected
  • 5.0.0 to < 5.2.2affected

References