IXON VPN Client CRLF injection flaw scores 9.6 CVSS
A privileged subprocess reads injected config lines that persist across reboots, cloud-side blocking stops new connections but does nothing about existing backdoors.
TL;DR
CISA published ICS Advisory ICSA-26-246-02 for CVE-2026-75925, a CRLF injection vulnerability in IXON VPN Client versions below 1.4.7. An unauthenticated attacker can inject configuration directives that a privileged subprocess later executes as root or SYSTEM. The injected configuration persists across restarts. IXON's cloud began rejecting connections from unpatched clients on August 5, 2026, so unpatched installations can no longer complete the exploit chain. Legacy installations that were already compromised before the cloud-side block, however, retain any injected backdoors, and the cloud rejection does nothing to remove them.
CISA published ICS Advisory ICSA-26-246-02 on September 3, 2026, covering CVE-2026-75925 in IXON's VPN Client. The vulnerability is a CRLF injection (CWE-93) with a CVSS 3.1 score of 9.6 and a CVSS 4.0 score of 9.4. Affected sectors span Commercial Facilities, Critical Manufacturing, Energy, Information Technology, and Water and Wastewater, with deployments worldwide.
The mechanics are straightforward and ugly. The IXON VPN Client's local service accepts configuration values without authenticating the requester (CWE-306, contributing). Those values are written to a file that a privileged subprocess later reads. Because line-ending sequences aren't neutralized, an attacker can inject additional directives into that file. The subprocess executes them as root on Linux and macOS or SYSTEM on Windows. The injected configuration persists on disk across reboots, and the VPN connection continues to function normally, so there's no behavioral change visible to the user.
IXON's remediation has two layers. First, update to VPN Client version 1.4.7 or later. Second, as of August 5, 2026, IXON's cloud rejects connections from clients below 1.4.7 at both the portal and the back-end API. Since the privileged subprocess and injected listener are only created when the client connects, unpatched installations cannot currently complete the exploit chain. Uninstall the client if it's no longer needed.
The cloud-side block is a meaningful stopgap, but it leaves a question hanging: what about machines that were compromised before August 5? The injected configuration persists across reboots and the cloud rejection doesn't remove it. CISA states that no known public exploitation specifically targeting this vulnerability has been reported to them at this time. But the absence of reports isn't the same as absence of compromise, and organizations running the IXON client in ICS environments should verify whether configuration files on those machines were tampered with.
This is the third notable IXON vulnerability in roughly a year. CVE-2025-26168 (Linux/macOS) and CVE-2025-26169 (Windows) were disclosed in May 2025, both local privilege escalation via race conditions on configuration files in world-writable directories, also scoring 8.1. Separately, CVE-2024-57790 documented hardcoded root credentials in the IXrouter IX2400 edge gateway. The pattern across these disclosures is a configuration-processing pipeline that's been given more trust than it can bear.
IXON's own Luuk van Rheden discovered CVE-2026-75925, and Stan van Duijnhoven reported it to CISA. The advisory is at the IXON Trust Center.
Published ·Deep Fathom