CVE-2025-8069: Local Privilege Escalation Vulnerability in AWS Client VPN Windows Client
During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x8664-openssl-localbuild\ssl directory location to fetch the OpenSSL configuration file. As a result, a non-admin user could place arbitrary code in the configuration file. If an admin user starts the AWS Client VPN client installation process, that code could be executed with root-level privileges. This issue does not affect Linux or Mac devices.
We recommend users discontinue any new installations of AWS Client VPN on Windows prior to version 5.2.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Discontinue any new installations of AWS Client VPN on Windows prior to version 5.2.2.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8069?
CVE-2025-8069 is classified as a vulnerability that poses a risk due to improper file access during the AWS Client VPN installation on Windows.
How do I fix CVE-2025-8069?
To fix CVE-2025-8069, ensure you are running an updated version of the AWS Client VPN beyond version 5.2.2.
What are the potential impacts of CVE-2025-8069?
The potential impacts of CVE-2025-8069 include the execution of arbitrary code by a non-admin user, which can lead to unauthorized actions.
Who is affected by CVE-2025-8069?
CVE-2025-8069 affects users of the Amazon AWS Client VPN on Windows devices up to version 5.2.2.
Is there a workaround for CVE-2025-8069?
As a workaround for CVE-2025-8069, restrict non-admin users from accessing the installation directory during the client installation process.