CVE-2022-25166

An issue was discovered in Amazon AWS VPN Client 2.0.0. It is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for parameters (such as auth-user-pass). When this file is imported and the client attempts to validate the file path, it performs an open operation on the path and leaks the user's Net-NTLMv2 hash to an external server. This could be exploited by having a user open a crafted malicious ovpn configuration file.

• CWE-200

• https://github.com/RhinoSecurityLabs/CVEsExploit, Third Party Advisory
• https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/Exploit, Third Party Advisory
• https://github.com/RhinoSecurityLabs/CVEsExploit, Third Party Advisory
• https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/Exploit, Third Party Advisory

Published

Apr 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25160Cleartext Storage of Sensitive Information vulnerability in …5.9
• CVE-2022-25161Improper Input Validation vulnerability in Mitsubishi Electr…8.6
• CVE-2022-25162Improper Input Validation vulnerability in Mitsubishi Electr…5.3
• CVE-2022-25163Improper Input Validation vulnerability in Mitsubishi Electr…9.8
• CVE-2022-25164Cleartext Storage of Sensitive Information vulnerability in …7.5
• CVE-2022-25165An issue was discovered in Amazon AWS VPN Client 2.0.0. A TO…7
• CVE-2022-25167Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to …9.8
• CVE-2022-25168Apache Hadoop's FileUtil.unTar(File, File) API does not esca…9.8
• CVE-2022-25169The BPG parser in versions of Apache Tika before 1.28.2 and …5.5
• CVE-2022-2517The Beaver Builder – WordPress Page Builder for WordPress is…5.4
• CVE-2022-25170The affected product is vulnerable to a stack-based buffer o…7.8
• CVE-2022-25171The package p4 before 0.0.7 are vulnerable to Command Inject…9.8