CVE-2022-25166

5.0 mediumEPSS 1.5%

An issue was discovered in Amazon AWS VPN Client 2.0.0. It is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for parameters (such as auth-user-pass). When this file is imported and the client attempts to validate the file path, it performs an open operation on the path and leaks the user's Net-NTLMv2 hash to an external server. This could be exploited by having a user open a crafted malicious ovpn configuration file.

Severity

CVSS 3.1

5.0 medium

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2022-04-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

amazon:aws_client_vpn

References

https://github.com/RhinoSecurityLabs/CVEs
https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/
https://github.com/RhinoSecurityLabs/CVEs
https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/

Check your stack JSON