AWS VPN Client CVE-2025-11462

Requires an existing local, non-administrator account on a macOS host with AWS VPN Client versions 1.3.2 through 5.2.0 installed. The attacker must be able to create a symlink at the client's log destination directory (the directory lacks sufficient validation during log rotation) and must issue crafted client API calls that inject arbitrary code into the log file, then trigger or wait for a log-rotation event performed under elevated privileges. Limiting factors: exploitation is local-only (AV:L - no remote/network path), demands a pre-existing local account (PR:L), is confined to macOS and only the 1.3.2-5.2.0 version range, and is fully remediated by upgrading to 5.2.1 or later.

This is a genuine high-priority local privilege escalation, not a high-CVSS-but-low-risk paper finding, though the risk is bounded by its local attack vector. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 9.3 and is internally consistent with the description: a non-administrator local user (PR:L) exploits a symlink/log-rotation flaw (CWE-59) to reach root, with full vulnerable- and subsequent-system impact (VC/VI/VA and SC/SI/SA all High), reflecting complete host compromise. Critically, there is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so exploitation probability signals are absent rather than low - this means no public exploit identified at time of analysis, and the 9.3 is driven purely by impact and ease once local access exists, not by observed or predicted real-world exploitation. The severity rests entirely on the local escalation chain; because AV:L requires the attacker to already have a local account, this is a second-stage/post-compromise privilege escalation rather than an internet-facing mass-exploitation risk. No key signals conflict with the description, but the absence of EPSS/KEV/POC should be read as 'unknown/unassessed' rather than 'confirmed low likelihood.'

A non-administrator user already logged into a macOS endpoint running AWS VPN Client (1.3.2-5.2.0) creates a symlink redirecting the client log file to a privileged location, then issues crafted API calls that inject attacker-controlled code into the log content. When the client performs log rotation under elevated context, the injected payload is written to the privileged path and executed with root privileges. No public exploit code was identified in the provided data.