InfoSecBulletin Cybersecurity for mankind
AWS has issued a security patch for a severe local privilege escalation vulnerability (CVE-2025-8069) in its Windows Client VPN software. Rated at CVSS 7.8, this flaw allows non-admin users to run code with higher privileges during installation, posing risks for shared or enterprise devices.
The issue lies in the way AWS Client VPN for Windows handles the OpenSSL configuration during installation. According to AWS, the installer incorrectly references a hardcoded file path:
Contract and server dispute brought down Bangladesh’s digital payment
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
“During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL configuration file.”
This directory can be modified by low-privileged users. If a malicious user adds a crafted config file here, and a system admin installs the VPN client, the malicious code might run with SYSTEM privileges, giving the attacker full control of the machine.
This vulnerability only affects Windows systems; Mac and Linux versions of the AWS Client VPN are not impacted.
The flaw impacts the following versions of the AWS Client VPN for Windows:
Amazon fixed a vulnerability in version 5.2.2 of the Client VPN software by eliminating references to an insecure directory path, preventing privilege escalation through OpenSSL configuration files.
System administrators should check their setups and upgrade to version 5.2.2 or higher. Older installation packages need to be removed from software catalogs to avoid accidental use.
