CVE-2025-8069

Published Jul 23, 2025

Last updated 3 months ago

CVSS high 7.3
AWS

Overview

Description
During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL configuration file. As a result, a non-admin user could place arbitrary code in the configuration file. If an admin user starts the AWS Client VPN client installation process, that code could be executed with root-level privileges. This issue does not affect Linux or Mac devices. We recommend users discontinue any new installations of AWS Client VPN on Windows prior to version 5.2.2.
Source
ff89ba41-3aa1-4d27-914a-91399e9639e5
NVD status
Deferred

Risk scores

CVSS 4.0

Type
Secondary
Base score
7.3
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
HIGH

CVSS 3.1

Type
Secondary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

ff89ba41-3aa1-4d27-914a-91399e9639e5
CWE-276

Social media

Hype score
Not currently trending

  1. ⚠️Vulnerabilidad en AWS Client VPN de Windows ❗CVE-2025-8069 ➡️Más info: https://t.co/jwg9dPDh6t https://t.co/dC0oWYZn65

    @CERTpy

    5 Aug 2025

    92 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Cybersecurity Alert! A critical vulnerability, CVE-2025-8069,has been discovered in Amazon Web Services (AWS) Client VPN for Windows, and this could leave users' systems wide open to attack. Read here: https://t.co/BbpzrD3V64 https://t.co/wnwjJcSprD

    @CybernalytixLtd

    25 Jul 2025

    40 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  3. AWS Client VPN for Windowsに権限昇格の脆弱性。CVE-2025-8069はインストール時の脆弱性。C:\usr\local\windows-x86_64-openssl-localbuild\sslの固定パスからOpenSSL構成ファイルを読み取ろうとするので、先回りして悪性コードを入れ

    @__kokumoto

    24 Jul 2025

    839 Impressions

    1 Retweet

    9 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  4. 🚨 Critical AWS Client VPN for Windows vuln (CVE-2025-8069) enables non-admin privilege escalation! ⚠️ Users could gain root access during installation. Patch now to v5.2.2 or higher. Secure your systems! #AWS #Cybersecurity #Vuln https://t.co/dKFVKygQZs

    @fernandokarl

    24 Jul 2025

    49 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. CVE-2025-8069 Local Privilege Escalation in AWS Client VPN on Windows via Configuration File Manipulation https://t.co/qoKqTvAYcq

    @VulmonFeeds

    23 Jul 2025

    63 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  6. CVE-2025-8069 During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory locati… https://t.co/PUoBWs8LgW

    @CVEnew

    23 Jul 2025

    291 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. CVE-2024-31884
  2. AWS Research and Engineering Studio (RES) is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue (CWE-59) in the Auth.GetUserPrivateKey API. An authenticated remote user could read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link targeting any file on the host. Because the cluster-manager process runs as root, any file readable by root is exposed, including other users' SSH private keys and application configuration secrets. It's recommended to upgrade to RES version 2026.06.•CVE-2026-14904
  3. containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into the restored container. Successful exploitation requires that the node has CDI enabled and contains a matching host CDI specification for the requested device; environments where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.•CVE-2026-53492
  4. containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an IfNotPresent (or Never) pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.•CVE-2026-50195
  5. Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register). To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.•CVE-2026-13769

References

Sources include official advisories and independent security research.