Skip to content
Sign in
7.3 High

CVE-2025-8069 During the AWS Client VPN client installation on Windows devices, the install process references the…

Description

During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL configuration file. As a result, a non-admin user could place arbitrary code in the configuration file. If an admin user starts the AWS Client VPN client installation process, that code could be executed with root-level privileges. This issue does not affect Linux or Mac devices. We recommend users discontinue any new installations of AWS Client VPN on Windows prior to version 5.2.2.

Affected products and versions

Product Affected versions Fixed in
Client VPN 5.0 5.0.0 → < 5.2.2 5.2.2
Client VPN 4.1.0 No fix stated

Other CVEs of Client VPN

The 2 CVEs of Client VPN →
CVE-2025-11462 Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to… 9.3 Critical
Track this CVE