VYPR
← All advisories
Medium severity5.0NVD Advisory· Published Apr 14, 2022· Updated Jun 17, 2026

CVE-2022-25166

CVE-2022-25166

Description

An issue was discovered in Amazon AWS VPN Client 2.0.0. It is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for parameters (such as auth-user-pass). When this file is imported and the client attempts to validate the file path, it performs an open operation on the path and leaks the user's Net-NTLMv2 hash to an external server. This could be exploited by having a user open a crafted malicious ovpn configuration file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Amazon/AWS Client VPN2 versions
    cpe:2.3:a:amazon:aws_client_vpn:2.0.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:amazon:aws_client_vpn:2.0.0:*:*:*:*:*:*:*
    • (no CPE)range: =2.0.0
  • Amazon/AWS VPN Clientdescription

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.