CVE-2025-11462 - CVE House

Back to Database

Status published Critical CVE-2025-11462

Local Privilege Escalation Vulnerability in AWS Client VPN macOS Client

9.3 CVSS

Vulnerability Description

Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges. Insufficient validation checks on the log destination directory during log rotation could allow a non-administrator user to create a symlink from a client log file to a privileged location. On log rotation, this could lead to code execution with root privileges if the user made crafted API calls which injected arbitrary code into the log file. We recommend users upgrade to AWS VPN Client for macOS 5.2.1 or the latest version.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-11462

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from AWS

View All →

Local Privilege Escalation Vulnerability in AWS Client VPN Windows Client

Path Traversal in AWS SAM CLI allows file copy to local cache

Path Traversal in AWS SAM CLI allows file copy to build container

Improper timestamp caching during snapshot rollback in tough

Failure to detect delegated target rollback in tough

Affected Vendor

AWS

View all reports →

Affected Software

Client VPN

Vulnerable Versions:

1.3.2

Timeline

Official Publish: October 7th, 2025

Last Modified: February 26th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1574 Hijack Execution Flow

Privilege Escalation

T1222 File and Directory Permissions Modification

Defense Evasion

T1005 Data from Local System

T1565 Data Manipulation

T1078 Valid Accounts