Critical CRLF Injection Vulnerability in IXON VPN Client Allows Root-Level Code Execution
A critical CRLF injection vulnerability in IXON VPN Client versions prior to 1.4.7 allows unauthenticated remote attackers to execute commands with root or SYSTEM privileges.
CISA has issued a warning regarding a critical vulnerability, CVE-2026-75925, affecting IXON VPN Client software. This flaw, present in versions before 1.4.7, enables unauthenticated remote attackers to achieve arbitrary code execution with elevated privileges on the affected system.
The vulnerability stems from the improper neutralization of line-ending sequences, specifically CRLF injection, within configuration values. These values are written to a file that is subsequently processed by a privileged subprocess. The lack of proper sanitization allows an attacker to introduce malicious directives into this configuration file, leading to the execution of arbitrary commands.
Adding to the severity, the configuration interface accepts changes without requiring authentication or verifying the origin of the request. This means an attacker could potentially exploit this weakness remotely. The injected configuration persists across client and operating system restarts, and crucially, the VPN connection continues to function normally, offering no visible behavioral changes to the user that might indicate a compromise.
The Common Vulnerability Scoring System (CVSS) v3.1 assigns this vulnerability a base score of 9.6, categorizing it as CRITICAL. The CVSS v4.0 score is also high at 9.4. The vulnerability impacts IXON VPN Client versions prior to 1.4.7 and is deployed worldwide across critical infrastructure sectors including Commercial Facilities, Critical Manufacturing, Energy, Information Technology, and Water and Wastewater.
IXON has provided a clear remediation path, recommending that users update the IXON VPN client to version 1.4.7 or later on all installed computers. For organizations that no longer require the VPN client, IXON advises uninstalling it entirely.
Furthermore, IXON has implemented backend mitigations. As of August 5, 2026, the IXON cloud platform actively rejects connections from clients running versions below 1.4.7. This measure prevents the completion of the exploit chain, as the privileged subprocess required for exploitation is only created when the client successfully connects.
While no public exploitation targeting this specific vulnerability has been reported to CISA at this time, the potential impact is significant. The ability for an unauthenticated remote attacker to execute commands as root or SYSTEM on a device running the VPN client poses a severe security risk, especially given its deployment in critical infrastructure environments.
CISA recommends that organizations minimize network exposure for all control system devices, ensure they are behind firewalls, and use secure methods like VPNs for remote access, while also ensuring these VPNs are kept up-to-date. Organizations should perform thorough impact analyses and risk assessments before deploying any defensive measures.