Vulnerability Description
During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL configuration file. As a result, a non-admin user could place arbitrary code in the configuration file. If an admin user starts the AWS Client VPN client installation process, that code could be executed with root-level privileges. This issue does not affect Linux or Mac devices. We recommend users discontinue any new installations of AWS Client VPN on Windows prior to version 5.2.2.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-014/
- https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-windows
FAQ
What is CVE-2025-8069?
CVE-2025-8069 is a vulnerability with a CVSS score of 7.8 (HIGH). During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL configur...
How severe is CVE-2025-8069?
CVE-2025-8069 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-8069?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.