AWS Client VPN for macOS Hit by Critical Privilege Escalation Vulnerability

Amazon Web Services (AWS) released bulletin AWS-2025-020 detailing a serious flaw in the macOS version of its Client VPN software, tracked as CVE-2025-11462. The vulnerability arises when the VPN client fails to validate the log destination directory during log rotation, enabling a local non-administrator user to exploit a symbolic link to a sensitive system location such as the crontab file.

An unprivileged user can cause the client to write rotated logs to the linked file with root privileges, potentially allowing arbitrary code execution as the root user. The flaw affects only the macOS Client VPN Client, with AWS Client VPN Client for macOS versions 1.3.2–5.2.0 being affected, and Windows and Linux editions remaining unaffected.

AWS has addressed the issue in version 5.2.1, and administrators are advised to upgrade immediately and incorporate the update into deployment pipelines, as no workarounds are available and rapid patching is recommended.