CVE-2024-30164

Amazon AWS Client VPN has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions. This is resolved in 3.11.1 on Windows, 3.9.1 on macOS, and 3.12.1 on Linux. NOTE: although the macOS resolution is the same as for CVE-2024-30165, this vulnerability on macOS is not the same as CVE-2024-30165.

• CWE-120

• https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-linux.html
• https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-macos.html
• https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-windows.html
• https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-linux.html
• https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-macos.html
• https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-windows.html

Published

May 28, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-30159A vulnerability in the web conferencing component of Mitel M…4.8
• CVE-2024-3016NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5…9.1
• CVE-2024-30160A vulnerability in the Suite Applications Services component…4.8
• CVE-2024-30161In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data mig…6.5
• CVE-2024-30162Invision Community through 4.7.16 allows remote code executi…7.2
• CVE-2024-30163Invision Community before 4.7.16 allow SQL injection via the…9.8
• CVE-2024-30165Amazon AWS Client VPN before 3.9.1 on macOS has a buffer ove…7.1
• CVE-2024-30166In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious cl…9.1
• CVE-2024-30167/cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.…6.3
• CVE-2024-3017In a Silicon Labs  multi-protocol gateway, a corrupt point…6.5
• CVE-2024-30170PrivX before 34.0 allows data exfiltration and denial of ser…9.1
• CVE-2024-30171An issue was discovered in Bouncy Castle Java TLS API and JS…5.9