InfoSecBulletin Cybersecurity for mankind
AWS has issued a security patch for a severe local privilege escalation vulnerability (CVE-2025-8069) in its Windows Client VPN software. Rated at CVSS 7.8, this flaw allows non-admin users to run code with higher privileges during installation, posing risks for shared or enterprise devices.
The issue lies in the way AWS Client VPN for Windows handles the OpenSSL configuration during installation. According to AWS, the installer incorrectly references a hardcoded file path:
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
“During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL configuration file.”
This directory can be modified by low-privileged users. If a malicious user adds a crafted config file here, and a system admin installs the VPN client, the malicious code might run with SYSTEM privileges, giving the attacker full control of the machine.
This vulnerability only affects Windows systems; Mac and Linux versions of the AWS Client VPN are not impacted.
The flaw impacts the following versions of the AWS Client VPN for Windows:
Amazon fixed a vulnerability in version 5.2.2 of the Client VPN software by eliminating references to an insecure directory path, preventing privilege escalation through OpenSSL configuration files.
System administrators should check their setups and upgrade to version 5.2.2 or higher. Older installation packages need to be removed from software catalogs to avoid accidental use.
