IXON Patches a 9.6-Severity RCE in Its Industrial VPN Client

An attacker who can push a malicious configuration update to IXON's VPN Client, without holding any credentials on the target machine, can run code as root or SYSTEM once the client applies it, according to a security advisory the Netherlands-based industrial remote-access vendor published Aug. 5. The flaw, CVE-2026-75925, is rated 9.6 out of 10 on the CVSS v3.1 scale.

The Cybersecurity and Infrastructure Security Agency republished the advisory for asset owners on Sept. 3, tracking it as ICSA-26-246-02. IXON's client is the software that connects industrial equipment, including programmable logic controllers and machine automation systems, to remote engineers and, in most deployments, to IXON's own cloud platform.

What the CRLF bug actually does

The vulnerability is a CRLF injection, catalogued under CWE-93, in how the client processes configuration updates. IXON's client accepts configuration changes without authenticating the sender and writes them to files that privileged subprocesses later read without stripping line-ending characters, according to CISA's advisory. Injecting those characters lets an attacker smuggle extra commands into a file a root or SYSTEM process eventually executes, and the resulting change persists across restarts rather than being cleared on reboot.

The score needs a precondition attached. CVSS v3.1 lists the attack vector as network-reachable with no privileges required, but user interaction is required, meaning the malicious configuration still has to reach the client and be applied, not merely be transmitted at it. CISA rates the same flaw 9.4 out of 10 under the newer CVSS v4.0 scale, a difference of 0.2 that reflects how the two versions weigh scope change differently rather than any disagreement about severity.

The fix, and a compensating control that arrived first

IXON's advisory says the fix shipped in VPN Client version 1.4.7; versions below that remain vulnerable. Since Aug. 5, the day the advisory was published, IXON's cloud infrastructure has rejected connections from unpatched clients, a compensating control that blocks the exploit path for any device still checking in with IXON's cloud even before it is manually updated. Both CISA and IXON say they have no reports of the flaw being exploited.

The advisory landed in the same stretch of weeks as CISA fixes for three high-severity flaws in NextGen's Mirth Connect and a hard-coded cryptographic key in AVEVA's pipeline integrity software, part of a steady flow of industrial advisories that rarely reaches the audience that patches consumer software on a Tuesday schedule.

1. IXON VPN Client9.6 CVSS v3.1 score
2. Orthanc DICOM Server8.1 CVSS v3.1 score
3. CareCam Pro IP Cameras6.8 CVSS v3.1 score

Source: CISA ICS and ICS-medical advisories, accessed 2026-09-11

Operators who cannot update immediately should not rely on the cloud-side block alone, since it only covers clients that reach IXON's cloud in the first place. IXON's own guidance for anyone who no longer needs remote access is blunter than a patch note: uninstall the client.