CVE-2025-0501
Published: 15 January 2025
Summary
CVE-2025-0501 is a high-severity Improper Certificate Validation (CWE-295) vulnerability in Amazon WorkSpaces (inferred from references). Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked in the top 48.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-17 (Public Key Infrastructure Certificates) and SC-23 (Session Authenticity).
Deeper analysis
CVE-2025-0501 is a vulnerability in the native clients for Amazon WorkSpaces when using the PCoIP protocol. It stems from improper certificate validation (CWE-295), which may enable an attacker to access remote sessions through a man-in-the-middle attack. The issue affects the Android, Linux, macOS, and Windows native clients for Amazon WorkSpaces, with a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact but requiring high attack complexity and user interaction.
An attacker with network access can exploit this vulnerability by positioning themselves for a man-in-the-middle interception, potentially without privileges, though it demands user interaction such as connecting through a malicious network or clicking a prompt. Successful exploitation grants high-impact access to remote WorkSpaces sessions, compromising confidentiality, integrity, and availability of the targeted sessions.
AWS has published a security bulletin at https://aws.amazon.com/security/security-bulletins/AWS-2025-001/ detailing the issue. Mitigation involves updating the affected native clients, with release notes available for Android (https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-android-client.html#android-release-notes), Linux (https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-linux-client.html#linux-release-notes), macOS (https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-osx-client.html#osx-release-notes), and Windows (https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notes).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1721
Vulnerability details
An issue in the native clients for Amazon WorkSpaces (when running PCoIP protocol) may allow an attacker to access remote sessions via man-in-the-middle.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper certificate validation directly enables man-in-the-middle positioning for session access, mapping to Adversary-in-the-Middle.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires proper management and validation of PKI certificates in WorkSpaces native clients, directly addressing the improper certificate validation (CWE-295) that enables MitM attacks.
Mandates timely flaw remediation through patching of vulnerable Amazon WorkSpaces clients as recommended by AWS, eliminating the PCoIP protocol vulnerability.
Ensures authenticity of PCoIP remote sessions, preventing attacker access via man-in-the-middle interception in WorkSpaces connections.