IXON VPN Client

1. Executive summary

CISA has published ICS advisory ICSA-26-246-02 covering CVE-2026-75925, a CRLF injection vulnerability (CWE-93, with CWE-306 as a contributing factor) in IXON VPN Client versions before 1.4.7. The flaw allows an attacker to inject additional directives into a configuration file consumed by a privileged subprocess, yielding command execution as root (Linux/macOS) or SYSTEM (Windows). CISA scores this CRITICAL at CVSS v3.1 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and CVSS v4.0 9.4. No known public exploitation targeting this vulnerability has been reported to CISA at this time. IXON Cloud has rejected connections from clients below v1.4.7 at both the portal and back-end API since 5 August 2026, which blocks completion of the exploit chain but leaves unpatched clients unable to connect — a functional outage risk for any EMEA financial services organisation relying on IXON for remote access to industrial, building-management or branch systems.

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged beyond generic incident/patching duties; the item is a single-vendor product vulnerability with no reported exploitation or incident.

3. Technical analysis & attack chain

Vulnerability: CVE-2026-75925 — Improper Neutralization of CRLF Sequences (CWE-93) in IXON VPN Client before 1.4.7, with missing authentication/origin verification on the configuration interface (CWE-306) as a contributing weakness. CVSS v3.1 9.6 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H); CVSS v4.0 9.4 CRITICAL.

Mechanism. The IXON VPN Client runs a local service that accepts configuration changes. Two flaws combine:

1. The configuration interface accepts changes without authenticating or verifying the origin of the requester (CWE-306). Any process or user on the machine — or a party able to reach that interface — can submit configuration values.
2. Accepted configuration values are written to a file that is later consumed by a privileged subprocess, without CRLF sequences being neutralised (CWE-93). An attacker who embeds line-ending sequences in a configuration value can break out of the intended directive and append arbitrary additional directives to that file. When the privileged subprocess (running as root or SYSTEM) parses the file, it executes the injected directives with full elevated privileges.

Confirmed attack chain

1. Attacker supplies a configuration value containing embedded CRLF sequences to the client's local configuration interface.
2. The value is written verbatim — line endings intact — into the configuration file on disk.
3. The injected directives persist in that file across restarts of both the client and the operating system.
4. On client connect, a privileged subprocess consumes the configuration file and acts on the injected directives, creating an injected listener and executing commands as root/SYSTEM.
5. The VPN connection continues to function normally; there is no behavioural change visible to the user, so the compromise is silent from the endpoint user's perspective.

Key defensive characteristics

• Persistence: the injected configuration survives client restarts and OS reboots — this is durable, on-disk persistence, not an in-memory one-shot.
• Stealth: normal VPN operation is preserved; no user-facing error or disruption signals the injection.
• Exploit-chain gate: the privileged subprocess and injected listener are only created when the client connects. Since 5 August 2026, IXON Cloud rejects connections from clients below v1.4.7 at both the portal and the back-end API, so an unpatched client cannot complete the chain against IXON Cloud. A client pointed at non-IXON infrastructure, or an on-premises/replay scenario, is not covered by this cloud-side control — the advisory's guarantee is specific to IXON Cloud connectivity.
• Scope of affected versions: IXON VPN Client < 1.4.7, all platforms where the client runs (the root/SYSTEM wording covers both Unix-family and Windows privilege contexts).
• Sectors listed by CISA as potentially affected: Commercial Facilities, Critical Manufacturing, Energy, Information Technology, Water and Wastewater; deployed worldwide; vendor headquartered in the Netherlands.

Caveats and confidence. The technical detail above is drawn entirely from the CISA ICS advisory (ICSA-26-246-02) and the IXON Trust Center advisory it references (ADV-2026-08-05). The advisory does not specify the exact configuration-file path, the interface's listening socket/port or IPC mechanism, the identity of the privileged subprocess, or the directives available for injection — those specifics are single-sourced to the vendor PDF and not reproduced in the CISA text; retrieve ADV-2026-08-05 directly before building host-specific detection. No exploitation has been reported to CISA, and no threat actor attribution is claimed by any source — treat this as a patch-priority vulnerability, not an active campaign. No KEV listing is indicated in the source material.

4. Mitigation & containment

P1 — within 24 hours

1. Inventory: enumerate all endpoints running IXON VPN Client and record versions. Prioritise machines used for remote access to OT, building management, branch or data-centre infrastructure.
2. Patch: update IXON VPN Client to version 1.4.7 or later on every computer where it is installed. This is the vendor's primary remediation.
3. Confirm cloud enforcement: verify in the IXON portal that no managed devices remain on client versions below 1.4.7. IXON Cloud has rejected sub-1.4.7 clients at the portal and back-end API since 5 August 2026 — any device still connecting is either patched or not connecting through IXON Cloud.

P2 — within 72 hours

4. Hunt for injected configuration: on any host found running a pre-1.4.7 client, review the client's configuration files for unexpected additional directives or line-ending anomalies within configuration values. Because the injection is persistent and user-invisible, assume a pre-1.4.7 client that has connected since deployment could carry an injected directive even if the VPN "works fine". Where the exact file path is needed, obtain it from IXON ADV-2026-08-05 or IXON support.
5. Restrict the configuration interface: until patching is complete, apply host firewall/EDR policy to prevent untrusted local processes and other network hosts from reaching the client's local configuration interface. (The advisory confirms the interface does not authenticate requesters; treat it as an unauthenticated local attack surface.)
6. Third-party check: contact any managed service provider or OT vendor that uses IXON to reach your environment and require written confirmation that their client build is ≥1.4.7.

P3 — within 7 days

7. Decommission where unused: if the client is no longer needed, uninstall the IXON VPN client from the computer — vendor-recommended.
8. Network hygiene (CISA recommended practices): minimise network exposure of control system devices and ensure they are not internet-accessible; keep control system networks and remote devices behind firewalls and isolated from business networks; where remote access is required, use secure methods and keep VPN software at the most current version, recognising that a VPN is only as secure as the connected devices.
9. Process: fold IXON client version into standard build images and software-allowlisting so pre-1.4.7 builds cannot be redeployed.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The CISA advisory and the reproduced IXON text provide no file paths, process names, registry keys, mutexes, command-line strings, network indicators or file hashes for the threat artefacts themselves. The only candidate strings (product name, CVE identifier, CWE labels) are reporting metadata, not threat artefacts, and would detect documentation rather than exploitation. Recommend requesting detection guidance and the exact configuration-file path from IXON via the Trust Center advisory (ADV-2026-08-05) and building a host-specific check for unexpected directives in that file once the path is confirmed.

7. Sources

• CISA, "IXON VPN Client", ICS Advisory ICSA-26-246-02, https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-02, initial publication 2026-08-05, republished by CISA 2026-09-03
• IXON, "IXON Trust Center Advisory ADV-2026-08-05", https://www.ixon.cloud/Advisories/ADV-2026-08-05.pdf, 2026-08-05 (referenced by CISA; not independently retrieved for this advisory)

8. Adverse Trace position

CVE-2026-75925 is a CRITICAL (CVSS v3.1 9.6 / v4.0 9.4) local-privilege-escalation-to-RCE flaw in IXON VPN Client <1.4.7 that combines an unauthenticated configuration interface with CRLF injection into a file consumed by a root/SYSTEM subprocess, producing silent, reboot-persistent elevated command execution. For EMEA financial services the exposure is concentrated where IXON is used for remote access to operational technology, facilities or branch infrastructure — the classic OT-adjacent footprint — and the practical near-term risk is as much operational as adversarial: IXON Cloud already hard-blocks sub-1.4.7 clients, so unpatched estates lose remote connectivity outright. No exploitation has been reported to CISA and no attribution exists; the technical detail beyond the mechanism is single-sourced to the vendor advisory, so verify configuration-file specifics with IXON before enforcing host-level detection. We rate this patch-now, not panic: complete the version 1.4.7 rollout across all endpoints and provider-managed connections within the P1/P2 windows, hunt pre-1.4.7 hosts for injected configuration, and decommission unused clients. Adverse Trace will monitor for KEV listing, proof-of-concept publication or exploitation reporting and will reissue this advisory if the threat picture changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.