CVE-2025-11462

Published Oct 7, 2025

Last updated 3 months ago

CVSS critical 9.3
AWS

Overview

Description
Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges. Insufficient validation checks on the log destination directory during log rotation could allow a non-administrator user to create a symlink from a client log file to a privileged location. On log rotation, this could lead to code execution with root privileges if the user made crafted API calls which injected arbitrary code into the log file. We recommend users upgrade to AWS VPN Client for macOS 5.2.1 or the latest version.
Source
ff89ba41-3aa1-4d27-914a-91399e9639e5
NVD status
Deferred

Risk scores

CVSS 4.0

Type
Secondary
Base score
9.3
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
CRITICAL

CVSS 3.1

Type
Secondary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

ff89ba41-3aa1-4d27-914a-91399e9639e5
CWE-59

Social media

Hype score
Not currently trending

  1. #VulnerabilityReport #AWS Critical AWS VPN Client Flaw CVE-2025-11462 (CVSS 9.3) Allows Root Privilege Escalation on macOS https://t.co/yIHUhWcRby

    @Komodosec

    14 Nov 2025

    13 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. ๐Ÿ” ๐‹๐š๐ญ๐ž๐ฌ๐ญ ๐‚๐•๐„ ๐›๐ซ๐ž๐š๐ค๐๐จ๐ฐ๐ง ๐š๐ฏ๐š๐ข๐ฅ๐š๐›๐ฅ๐ž ๐ง๐จ๐ฐ! Patch now: A critical flaw in AWS VPN for macOS lets attackers escalate to root. Learn how CVE-2025-11462 works and how to defend against it. ๐ŸŒ E

    @PurpleOps_io

    9 Oct 2025

    52 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. AWS VPN Client Flaw CVE-2025-11462 Grants Unauthenticated Root Access on macOS Systems Read the full report on - https://t.co/527YW2i4J5 https://t.co/yUqfqe28Q9

    @cyberbivash

    8 Oct 2025

    4 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. AWSใฏmacOS็‰ˆใ€ŒAWS Client VPNใ€ใซใŠใ„ใฆใ€ใƒญใƒผใ‚ซใƒซๆจฉ้™ๆ˜‡ๆ ผใฎ้‡ๅคงใช่„†ๅผฑๆ€ง๏ผˆCVE-2025-11462๏ผ‰ใ‚’ๅ…ฌ่กจใ—ใŸใ€‚ไธ€่ˆฌใƒฆใƒผใ‚ถใƒผใŒrootๆจฉ้™ใ‚’ๅ–ๅพ—ใงใใ‚‹ๅฏ่ƒฝๆ€งใŒใ‚ใ‚‹ใ€‚ๅŽŸๅ› ใฏใƒญใ‚ฐใƒญใƒผใƒ†ใƒผใ‚ทใƒงใƒณๆ™‚ใฎใ‚ทใƒณใƒœใƒชใƒƒใ‚ฏใƒชใƒณใ‚ฏๆ“ไฝœใ‚’

    @yousukezan

    8 Oct 2025

    3539 Impressions

    3 Retweets

    21 Likes

    12 Bookmarks

    0 Replies

    0 Quotes

  5. CVE-2025-11462 Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges. Insuffโ€ฆ https://t.co/wqWtRYgDXV

    @CVEnew

    7 Oct 2025

    274 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. CVE-2024-31884
  2. AWS Research and Engineering Studio (RES) is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue (CWE-59) in the Auth.GetUserPrivateKey API. An authenticated remote user could read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link targeting any file on the host. Because the cluster-manager process runs as root, any file readable by root is exposed, including other users' SSH private keys and application configuration secrets. It's recommended to upgrade to RES version 2026.06.โ€ขCVE-2026-14904
  3. containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into the restored container. Successful exploitation requires that the node has CDI enabled and contains a matching host CDI specification for the requested device; environments where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.โ€ขCVE-2026-53492
  4. containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an IfNotPresent (or Never) pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.โ€ขCVE-2026-50195
  5. Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register). To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.โ€ขCVE-2026-13769

References

Sources include official advisories and independent security research.