InfoSecBulletin Cybersecurity for mankind
AWS has issued a security patch for a severe local privilege escalation vulnerability (CVE-2025-8069) in its Windows Client VPN software. Rated at CVSS 7.8, this flaw allows non-admin users to run code with higher privileges during installation, posing risks for shared or enterprise devices.
The issue lies in the way AWS Client VPN for Windows handles the OpenSSL configuration during installation. According to AWS, the installer incorrectly references a hardcoded file path:
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
“During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL configuration file.”
This directory can be modified by low-privileged users. If a malicious user adds a crafted config file here, and a system admin installs the VPN client, the malicious code might run with SYSTEM privileges, giving the attacker full control of the machine.
This vulnerability only affects Windows systems; Mac and Linux versions of the AWS Client VPN are not impacted.
The flaw impacts the following versions of the AWS Client VPN for Windows:
Amazon fixed a vulnerability in version 5.2.2 of the Client VPN software by eliminating references to an insecure directory path, preventing privilege escalation through OpenSSL configuration files.
System administrators should check their setups and upgrade to version 5.2.2 or higher. Older installation packages need to be removed from software catalogs to avoid accidental use.
