Introduction
An attacker with local access to a macOS system running AWS Client VPN can escalate to root by exploiting a flaw in how the client rotates its logs. In enterprise environments where several users share a device, or where remote access is common, this vulnerability could let a non-admin user take full control of an unpatched system.
About AWS Client VPN: Amazon Web Services (AWS) is the world's leading cloud service provider, with millions of customers. AWS Client VPN is a managed VPN service that provides secure remote access to AWS and on-premises networks. Because organizations in many industries use it, a vulnerability in this product has a wide impact.
Technical information
CVE-2025-11462 is a local privilege escalation vulnerability in AWS Client VPN for macOS, affecting versions 1.3.2 through 5.2.0. The root cause is improper validation of log file paths during log rotation. The client does not check whether a log file is a symbolic link before it writes to it.
Attack flow:
- A non-admin user creates a symbolic link from a VPN client log file to a privileged location, such as
/etc/crontab. - The attacker sends crafted API calls to the VPN client, so that arbitrary code or cron job entries end up in the log output.
- When the VPN client rotates its logs, it writes the log contents, injected code included, to the privileged location the symlink points to.
- If the target is a file like
/etc/crontab, cron executes the injected code as root on its next run, which gives the attacker root privileges.
The vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access). The attack works because the VPN client runs with elevated privileges and does not adequately check where its log writes land during rotation.
Patch information
AWS has released version 5.2.1 of the macOS client, which fixes CVE-2025-11462. The update adds stronger validation of the log destination directory during log rotation, which mitigates the symbolic link attack.
In the vulnerable versions (1.3.2 through 5.2.0), the client did not adequately verify log file paths, so a non-administrator user could use a symbolic link to point a client log file at a privileged location. An attacker could exploit this to execute arbitrary commands with root privileges during log rotation.
Version 5.2.1 validates log paths strictly, so the client writes log files only to authorized directories. Unauthorized users can no longer redirect log output to sensitive system files.
Users should upgrade to AWS Client VPN Client version 5.2.1 to protect their systems against this vulnerability.
Patch source: AWS Security Bulletin
Affected systems and versions
- Product: AWS Client VPN for macOS
- Affected versions: 1.3.2 through 5.2.0 (inclusive)
- Only the macOS client is affected. Clients on other operating systems are not.
Vendor security history
AWS Client VPN has had several recent privilege escalation vulnerabilities:
- CVE-2024-30165 (macOS): Allowed local attackers to uninstall the VPN client and exploit launchd persistence for privilege escalation.
- CVE-2025-8069 (Windows): Allowed non-admin users to place malicious OpenSSL config files that executed code when an admin installed the client.
AWS typically patches quickly, but privilege escalation bugs keep recurring in the Client VPN product line. That points to ongoing problems with secure file handling and with enforcing privilege boundaries.
