High severity · published Jan 15, 2025
CVE-2025-0500
Issue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clients
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
An issue in the native clients for Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to access remote sessions via man-in-the-middle.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A2
AppStream 2.0 Client · Amazon
1.1.1025 before 1.1.1332 · source: vendor
DC
DCV Client · Amazon
before 2023.1.6703; 2020.2.7459 before 2023.1.9127; 2020.2.2078 before 2023.1.6703 · source: vendor
WC
WorkSpaces Client · Amazon
5.0.0 before 5.21.0; 2023.0 before 2024.2; 5.5.0 before 5.21.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0500
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0500
aws.amazon.com
https://aws.amazon.com/security/security-bulletins/AWS-2025-001/
docs.aws.amazon.com
https://docs.aws.amazon.com/appstream2/latest/developerguide/client-release-versions.html
docs.aws.amazon.com
https://docs.aws.amazon.com/dcv/latest/adminguide/doc-history-release-notes.html#dcv-2023-1-16388jul
docs.aws.amazon.com
https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-linux-client.html#linux-release-notes
docs.aws.amazon.com
https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-osx-client.html#osx-release-notes
docs.aws.amazon.com
https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notes