IXON VPN Client flaw enables privileged RCE
A CRLF injection bug in IXON VPN Client before 1.4.7 lets local attackers escalate to root/SYSTEM via unauthenticated config injection.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory for CVE-2026-75925, a CRLF injection vulnerability (CWE-93) in IXON VPN Client versions prior to 1.4.7. The local configuration service accepts unauthenticated changes and writes them to a file consumed by a privileged subprocess without neutralizing line-ending sequences, allowing an attacker to inject additional directives that execute with root or SYSTEM privileges. A contributing weakness (CWE-306, missing authentication) means the configuration interface does not verify the origin of requests. The injected configuration persists across restarts and does not produce any visible behavioral change to the VPN connection, making detection difficult through normal user observation.
IXON has released version 1.4.7 to address the flaw and, as of August 5, 2026, the IXON cloud backend rejects connections from clients running versions below 1.4.7 at both the portal and API level, which breaks the exploit chain since the privileged subprocess and injected listener are only created upon a successful cloud connection. IXON also recommends uninstalling the client entirely if it is no longer needed. This affects deployments across Commercial Facilities, Critical Manufacturing, Energy, Information Technology, and Water and Wastewater sectors worldwide, with the vendor headquartered in the Netherlands.
No known public exploitation has been reported to CISA at this time. CISA's standard ICS mitigations apply: minimize internet exposure of control system devices, isolate ICS networks behind firewalls, and use secure remote access methods. Organizations running affected IXON VPN Client versions should prioritize the update to 1.4.7 or later given the elevated-privilege impact, even absent confirmed in-the-wild exploitation.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-02
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs