CVE-2025-11462: AWS VPN Client macOS Privilege Escalation

CVE-2025-11462 Overview

CVE-2025-11462 is a local privilege escalation vulnerability in the AWS VPN Client for macOS versions 1.3.2 through 5.2.0. The flaw stems from improper link resolution before file access [CWE-59] during log rotation. A non-administrator local user can create a symbolic link from a client log file to a privileged file system location. When the client rotates logs, it follows the symlink and writes attacker-controlled content to that privileged path. Combined with crafted API calls that inject arbitrary content into the log stream, this behavior enables code execution with root privileges. Amazon Web Services (AWS) addressed the issue in AWS VPN Client for macOS 5.2.1.

Critical Impact
A local low-privileged user can escalate to root on macOS endpoints running affected AWS VPN Client versions by abusing symlink handling during log rotation.

Affected Products

AWS VPN Client for macOS 1.3.2 through 5.2.0
macOS endpoints where the AWS VPN Client is installed and used interactively
Environments distributing the AWS VPN Client via managed software deployment prior to 5.2.1

Discovery Timeline

2025-10-07 - CVE-2025-11462 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-11462

Vulnerability Analysis

The AWS VPN Client for macOS writes runtime diagnostic data to a log file and rotates that file when size or time thresholds are reached. During rotation, the client accesses the log destination path without validating whether the target is a symbolic link. An attacker with local, unprivileged access can replace or create the log file as a symlink pointing to a root-owned location. The rotation routine, which executes with elevated privileges, then follows the symlink and writes to that target. This is a classic Time-of-Check to Time-of-Use (TOCTOU) pattern rooted in unsafe file handling.

Root Cause

The root cause is insufficient validation of the log destination directory and file handles before file access, mapped to [CWE-59] Improper Link Resolution Before File Access. The privileged log rotation logic does not verify that the destination path is a regular file owned by the expected principal, nor does it use symlink-safe primitives such as O_NOFOLLOW or resolved absolute path checks prior to writing.

Attack Vector

Exploitation requires local access with low privileges on the macOS host. The attacker performs three steps. First, they place a symlink at a predictable log path pointing to a privileged target such as a LaunchDaemon plist or a script executed at boot. Second, they issue crafted API calls to the VPN client that cause attacker-controlled strings to be written into the log stream. Third, they trigger or wait for log rotation, at which point the privileged process writes the poisoned content through the symlink to the root-owned target. On next execution, the injected content runs with root privileges.

No verified public exploit code has been released. See the AWS Security Bulletin AWS-2025-020 for the vendor's technical description.

Detection Methods for CVE-2025-11462

Indicators of Compromise

Symbolic links present in the AWS VPN Client log directory that resolve to paths outside the user's home directory or to system locations such as /Library/LaunchDaemons/ or /private/etc/.
Unexpected modifications to root-owned files with timestamps that align with AWS VPN Client log rotation events.
AWS VPN Client log entries containing binary payloads, shell metacharacters, or plist/XML fragments consistent with injection attempts.

Detection Strategies

Endpoint file integrity monitoring focused on LaunchDaemon, LaunchAgent, and cron directories, correlated with the AWS VPN Client process lineage.
Behavioral detection for a non-root user process creating symlinks in directories subsequently written to by a privileged AWS VPN Client helper.
Version inventory queries that flag any macOS host running AWS VPN Client between 1.3.2 and 5.2.0.

Monitoring Recommendations

Collect macOS Endpoint Security telemetry for ES_EVENT_TYPE_NOTIFY_CREATE and ES_EVENT_TYPE_NOTIFY_LINK events targeting AWS VPN Client log paths.
Alert on any process spawned as root whose parent chain includes files recently written by the AWS VPN Client log rotation routine.
Monitor for anomalous local API interactions with the AWS VPN Client, particularly high-volume or malformed requests that could seed log injection.

How to Mitigate CVE-2025-11462

Immediate Actions Required

Upgrade the AWS VPN Client for macOS to version 5.2.1 or later on all affected endpoints.
Inventory macOS hosts to identify any installations in the vulnerable range 1.3.2 through 5.2.0.
Audit the AWS VPN Client log directory for pre-existing symlinks and remove any that resolve to privileged locations.

Patch Information

AWS released the fix in AWS VPN Client for macOS 5.2.1. Refer to the AWS Client VPN macOS Release Notes for the current version and the AWS Security Bulletin AWS-2025-020 for advisory details. The patched build addresses the symlink handling in the log rotation path.

Workarounds

If patching is not immediately possible, restrict local interactive access to macOS hosts running the AWS VPN Client and remove standard-user shell access where feasible.
Temporarily disable the AWS VPN Client service on shared or multi-user macOS systems until upgrade to 5.2.1 completes.
Apply strict file system permissions on the AWS VPN Client log directory to prevent unauthorized users from creating or replacing files within it.

bash

# Verify installed AWS VPN Client version on macOS
mdls -name kMDItemVersion "/Applications/AWS VPN Client/AWS VPN Client.app"

# List symlinks in the AWS VPN Client log directory for review
find ~/.config/AWSVPNClient/logs -type l -exec ls -l {} \;