CISA 2026-09-03

IXON VPN Client

CVE-2026-75925

Machine-generated analysis · WAYSCloud LLM

IXON VPN Client versions prior to 1.4.7 are vulnerable to CRLF injection that can lead to remote code execution with root or SYSTEM privileges.

Context

The advisory concerns the IXON VPN Client software. Versions earlier than 1.4.7 contain an improper neutralization of CRLF sequences that can allow an attacker to execute commands as root or SYSTEM via a configuration file injection. The client accepts configuration changes without authentication, and the injected configuration persists across restarts while the VPN connection appears normal.

Operator considerations

Check: Verify the installed IXON VPN Client version on all endpoints.
Isolate: Block VPN connections from clients running versions earlier than 1.4.7 until they are updated.
Patch: Upgrade the IXON VPN Client to version 1.4.7 or later.
Log: Monitor for unexpected configuration file changes or connection attempts from clients below version 1.4.7.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow an attacker to perform remote code execution on the computer running the client with elevated privileges.

The following versions of IXON VPN Client are affected:

VPN Client

Read the full advisory on CISA →