Overview
CISA has republished ICS advisory ICSA-26-246-02, covering CVE-2026-75925, a critical vulnerability in the IXON VPN Client — remote-access software widely deployed across industrial and OT environments to give technicians secure connectivity into machine networks. The flaw allows a local attacker to escalate privileges to root (Linux/macOS) or SYSTEM (Windows) by injecting CRLF (carriage-return/line-feed) sequences into configuration values handled by the client's local service.
IXON, headquartered in the Netherlands, sells its remote-access platform into Commercial Facilities, Critical Manufacturing, Energy, Information Technology, and Water and Wastewater sectors worldwide, making this a broad OT supply-chain concern rather than a niche desktop bug.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-75925 |
| Severity | Critical |
| CVSS v3.1 | 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) |
| CVSS v4.0 | 9.4 |
| Weakness | CWE-93 (Improper Neutralization of CRLF Sequences), contributing CWE-306 (Missing Authentication for Critical Function) |
| Attack Vector | Local |
| Authentication | None required on the local configuration interface |
| Affected Versions | IXON VPN Client before 1.4.7 |
How It Works
The IXON VPN Client runs a local service that accepts configuration changes without authenticating or verifying the origin of the request. That interface writes submitted configuration values to a file that is later read by a privileged subprocess. Because line-ending sequences in those values aren't neutralized, an attacker can embed CRLF characters in a config value to terminate the intended line early and inject additional directives of their own choosing into the file.
Once written, the malicious configuration persists on disk across restarts of both the client and the underlying operating system. The VPN tunnel keeps functioning normally throughout, so there's no visible disruption to alert a user that the client has been tampered with — the injected directives execute silently under the privileged subprocess's context the next time it processes the file.
Exploitation requires local access to the machine running the client; there is no remote, pre-auth path to this specific flaw. It maps to MITRE ATT&CK technique T1068 (Exploitation for Privilege Escalation).
Impact Assessment
An attacker who already has a foothold on a machine running a vulnerable IXON VPN Client — for example via phishing, a separate initial-access vulnerability, or physical access — can use this flaw to jump from a low-privilege local account straight to root or SYSTEM. In OT and ICS environments, where the VPN client is often the trusted bridge between a technician's laptop and a segmented machine network, that escalation can translate into:
- Full control over the host running the VPN client, including its network position
- Ability to tamper with or pivot through the VPN tunnel into the connected industrial network
- Long-term, boot-persistent access that survives reboots and patch cycles for the client itself (though not the underlying config file)
Exploitation Status
CISA states there is no known public exploitation targeting CVE-2026-75925 at this time. Advisory ICSA-26-246-02 was published/republished September 3, 2026.
Mitigation
Vendor Response
IXON has released version 1.4.7, which fixes the CRLF neutralization and authentication gaps. As an additional compensating control, IXON Cloud has rejected connections from clients older than v1.4.7 at both the portal and back-end API since August 5, 2026, which blocks the ability to complete the full exploit chain against cloud-managed deployments — but leaves any still-outdated clients unable to connect at all, creating an operational availability problem on top of the security one.
Recommended Actions
- Upgrade every IXON VPN Client installation to 1.4.7 or later immediately.
- If a client cannot be upgraded, uninstall it rather than leave a vulnerable, network-connectivity-breaking version in place.
- Audit local machines that run the IXON VPN Client for unexpected configuration entries or unexplained privileged process activity, especially on systems that bridge to OT/ICS networks.
- Restrict local access to hosts running remote-access VPN clients — this vulnerability requires only local access to exploit, so standard endpoint hardening (limiting local admin rights, disabling unnecessary local services) reduces the attack surface.
- Treat the IXON VPN Client as part of your OT supply chain — track its version alongside the industrial software it grants access to, not as a generic desktop utility.