CVE-2026-75925

Received Received - Intake

Improper CRLF Neutralization in IXON VPN Client

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: ICS-CERT

Description

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester. The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2026-75925

Affected Vendors & Products

Vendor	Product	Version / Range
ixon	vpn_client	to 1.4.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7. An attacker can execute commands as root or SYSTEM by injecting malicious configuration values into a file used by a privileged subprocess. The configuration interface allows changes without authentication or verification of the requester.

Detection Guidance

Detecting this vulnerability requires checking the IXON VPN Client version and inspecting configuration files for CRLF injection. Verify if the installed version is before 1.4.7. Examine configuration files in the VPN client's installation directory for unexpected line-ending sequences or unauthorized directives.

Impact Analysis

An attacker could gain full control over the system running the vulnerable VPN client. This includes executing arbitrary commands with elevated privileges, potentially leading to data theft, system compromise, or further network infiltration. The attack is persistent across restarts and remains undetected by the user.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using the affected VPN client may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Immediately update the IXON VPN Client to version 1.4.7 or later. Review and sanitize any configuration files that may have been modified. Ensure no unauthorized directives were added to these files. Monitor system logs for unusual activity related to the VPN client.

Hi! I’m here to help you understand CVE-2026-75925. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70