InfoSecBulletin Cybersecurity for mankind
AWS has issued a security patch for a severe local privilege escalation vulnerability (CVE-2025-8069) in its Windows Client VPN software. Rated at CVSS 7.8, this flaw allows non-admin users to run code with higher privileges during installation, posing risks for shared or enterprise devices.
The issue lies in the way AWS Client VPN for Windows handles the OpenSSL configuration during installation. According to AWS, the installer incorrectly references a hardcoded file path:
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
“During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL configuration file.”
This directory can be modified by low-privileged users. If a malicious user adds a crafted config file here, and a system admin installs the VPN client, the malicious code might run with SYSTEM privileges, giving the attacker full control of the machine.
This vulnerability only affects Windows systems; Mac and Linux versions of the AWS Client VPN are not impacted.
The flaw impacts the following versions of the AWS Client VPN for Windows:
Amazon fixed a vulnerability in version 5.2.2 of the Client VPN software by eliminating references to an insecure directory path, preventing privilege escalation through OpenSSL configuration files.
System administrators should check their setups and upgrade to version 5.2.2 or higher. Older installation packages need to be removed from software catalogs to avoid accidental use.
