CVE-2022-25166

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

An issue was discovered in Amazon AWS VPN Client 2.0.0. It is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for parameters (such as auth-user-pass). When this file is imported and the client attempts to validate the file path, it performs an open operation on the path and leaks the user's Net-NTLMv2 hash to an external server. This could be exploited by having a user open a crafted malicious ovpn configuration file.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/RhinoSecurityLabs/CVEsExploit, Third Party Advisory
https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/Exploit, Third Party Advisory
https://github.com/RhinoSecurityLabs/CVEsExploit, Third Party Advisory
https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/Exploit, Third Party Advisory

Timeline

Published: Apr 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-251679.8Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with CVE-2022-251689.8Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject CVE-2022-251695.5The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.CVE-2022-25175.4The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Caption - On Hover' value as CVE-2022-251707.8The affected product is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute a CVE-2022-251719.8The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization CVE-2022-251726.1An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The CVE-2022-251738.8Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script CVE-2022-251748.8Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipe CVE-2022-251758.8Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted CVE-2022-251766.5Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the CVE-2022-251776.5Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected P