CVE-2025-8069CWE-276

Local Privilege Escalation Vulnerability in AWS Client VPN Windows Client

High · published July 23, 2025

CVSS v4.0
7.3
EPSS
0%
Percentile
8.0
In the wild
Unconfirmed
What it is

During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL configuration file. As a result, a non-admin user could place arbitrary code in the configuration file. If an admin user starts the AWS Client VPN client installation process, that code could be executed with root-level privileges. This issue does not affect Linux or Mac devices.

We recommend users discontinue any new installations of AWS Client VPN on Windows prior to version 5.2.2.

The record
Technical detail
CVSS v4.0
7.3 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00188 · 8.0th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2025-07-23T15:41Z
EPSS history
Timeline
  • 23 JUL 15:41Z
    Local Privilege Escalation Vulnerability in AWS Client VPN Windows Client
    cvelistv5