InfoSecBulletin Cybersecurity for mankind
AWS has issued a security patch for a severe local privilege escalation vulnerability (CVE-2025-8069) in its Windows Client VPN software. Rated at CVSS 7.8, this flaw allows non-admin users to run code with higher privileges during installation, posing risks for shared or enterprise devices.
The issue lies in the way AWS Client VPN for Windows handles the OpenSSL configuration during installation. According to AWS, the installer incorrectly references a hardcoded file path:
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
“During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL configuration file.”
This directory can be modified by low-privileged users. If a malicious user adds a crafted config file here, and a system admin installs the VPN client, the malicious code might run with SYSTEM privileges, giving the attacker full control of the machine.
This vulnerability only affects Windows systems; Mac and Linux versions of the AWS Client VPN are not impacted.
The flaw impacts the following versions of the AWS Client VPN for Windows:
Amazon fixed a vulnerability in version 5.2.2 of the Client VPN software by eliminating references to an insecure directory path, preventing privilege escalation through OpenSSL configuration files.
System administrators should check their setups and upgrade to version 5.2.2 or higher. Older installation packages need to be removed from software catalogs to avoid accidental use.
