Description
An issue in the native clients for Amazon WorkSpaces (when running PCoIP protocol) may allow an attacker to access remote sessions via man-in-the-middle.
References (5)
Core 5
Core References
Various Sources vendor-advisory
https://aws.amazon.com/security/security-bulletins/AWS-2025-001/
Various Sources patch
release-notes
https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notes
Various Sources patch
release-notes
https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-osx-client.html#osx-release-notes
Various Sources patch
release-notes
https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-linux-client.html#linux-release-notes
Various Sources patch
release-notes
https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-android-client.html#android-release-notes
Scores
CVSS v3
7.5
EPSS
0.0044
EPSS Percentile
35.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-295
Status
published
Products (3)
Amazon/WorkSpaces Client
3.0.0 - 2024.6
Amazon/WorkSpaces Client
3.0.0 - 5.22.1
Amazon/WorkSpaces Client
3.0.1 - 5.0.1
Published
Jan 15, 2025
Tracked Since
Feb 18, 2026