CVE-2026-75925 Overview
CVE-2026-75925 is a CRLF injection vulnerability in the IXON VPN Client before version 1.4.7. The client's local service accepts configuration values and writes them to a file consumed by a privileged subprocess. Because line-ending sequences are not neutralized, an attacker can inject additional directives that the privileged process executes as root on Linux/macOS or SYSTEM on Windows. The configuration interface accepts changes without authenticating or verifying the origin of the requester. Injected directives persist across client and operating system restarts, and the VPN connection continues to function normally, so no behavioral change is visible to the user. The issue is tracked under CWE-93: Improper Neutralization of CRLF Sequences.
Critical Impact
An unauthenticated attacker able to reach the local configuration interface can inject VPN configuration directives that execute commands with root or SYSTEM privileges and persist across reboots.
Affected Products
- IXON VPN Client for Windows before version 1.4.7
- IXON VPN Client for Linux before version 1.4.7
- IXON VPN Client for macOS before version 1.4.7
Discovery Timeline
- 2026-09-04 - CVE-2026-75925 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-75925
Vulnerability Analysis
The IXON VPN Client exposes a local service that accepts configuration updates from clients on the host. Values submitted through this interface are appended to a configuration file that a separate, higher-privileged subprocess later reads and acts upon. The local service does not authenticate callers and does not validate the origin of the request, so any local process, and in some deployment scenarios any network-reachable component, can submit configuration changes.
Because the service does not strip or escape carriage return (\r) and line feed (\n) characters embedded in field values, an attacker can smuggle entirely new configuration directives into the file. When the privileged subprocess parses that file, it treats the injected lines as legitimate directives and executes them at root or SYSTEM level. Attackers can leverage directives that invoke external scripts or commands to achieve arbitrary command execution.
The injected content is written to disk, so the malicious configuration survives client restarts and full operating system reboots. The VPN tunnel continues to negotiate and pass traffic normally, giving the user no visible indication that the client configuration has been tampered with.
Root Cause
The root cause is missing neutralization of CRLF sequences in configuration field handling, combined with a trust boundary violation: an unauthenticated local interface writes attacker-controlled data to a file that a privileged process treats as authoritative.
Attack Vector
An attacker submits a crafted configuration value containing embedded \r\n sequences to the client's local configuration endpoint. No authentication is required. The privileged subprocess subsequently consumes the tampered file and executes the injected directives. Details are published in CISA ICS Advisory ICSA-26-246-02 and IXON Advisory ADV-2026-08-05.
Detection Methods for CVE-2026-75925
Indicators of Compromise
- Unexpected directives, script paths, or command invocations appearing in the IXON VPN Client configuration file on disk.
- Child processes spawned by the IXON privileged service that do not match the vendor's expected process tree.
- Modifications to the client configuration file with no corresponding administrative change record.
- Outbound network connections initiated by processes launched from the VPN client's privileged subprocess.
Detection Strategies
- Monitor file integrity on the IXON VPN Client configuration file and alert on writes not associated with a legitimate installer or administrative action.
- Baseline the process tree of the IXON privileged service and alert on deviations, particularly shell interpreters or scripting runtimes launched as root or SYSTEM.
- Inspect endpoint telemetry for command lines containing CRLF-encoded payloads directed at the local IXON configuration interface.
Monitoring Recommendations
- Forward endpoint process, file, and network telemetry to a centralized data lake for correlation across hosts running the IXON VPN Client.
- Track version inventory for IXON VPN Client installations and flag any host still running a release earlier than 1.4.7.
- Alert on new persistence artifacts introduced under the IXON installation directory or associated service configuration paths.
How to Mitigate CVE-2026-75925
Immediate Actions Required
- Upgrade all IXON VPN Client installations to version 1.4.7 or later on Windows, Linux, and macOS.
- Audit the client configuration file on each host for unexpected directives, script references, or commands and remove any that were not authorized.
- Restrict local access to endpoints running the client until patching is complete, and review recent privileged process activity for signs of exploitation.
Patch Information
IXON has released version 1.4.7 of the VPN Client, which neutralizes CRLF sequences in configuration input. Refer to the IXON Advisory ADV-2026-08-05 and the CISA ICS Advisory ICSA-26-246-02 for vendor guidance and downloads. The machine-readable advisory is available as a CSAF JSON file.
Workarounds
- No vendor-supplied workaround eliminates the vulnerability; upgrading to 1.4.7 is required.
- As a temporary compensating control, restrict which local users and processes can reach the client's local configuration interface using host-based firewall rules or OS access controls.
- Enforce application allowlisting on hosts running the client to limit which binaries the privileged subprocess can launch.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.