IXON Patches a 9.6-Severity RCE in Its Industrial VPN Client
Security / news
IXON Patches a 9.6-Severity RCE in Its Industrial VPN Client
An unauthenticated attacker who can push the client a malicious configuration can run code as root or SYSTEM on the machine it is installed on.
An attacker who can push a malicious configuration update to IXON's VPN Client, without holding any credentials on the target machine, can run code as root or SYSTEM once the client applies it, according to a security advisory the Netherlands-based industrial remote-access vendor published Aug. 5. The flaw, CVE-2026-75925, is rated 9.6 out of 10 on the CVSS v3.1 scale.
The Cybersecurity and Infrastructure Security Agency republished the advisory for asset owners on Sept. 3, tracking it as ICSA-26-246-02. IXON's client is the software that connects industrial equipment, including programmable logic controllers and machine automation systems, to remote engineers and, in most deployments, to IXON's own cloud platform.
What the CRLF bug actually does
The vulnerability is a CRLF injection, catalogued under CWE-93, in how the client processes configuration updates. IXON's client accepts configuration changes without authenticating the sender and writes them to files that privileged subprocesses later read without stripping line-ending characters, according to CISA's advisory. Injecting those characters lets an attacker smuggle extra commands into a file a root or SYSTEM process eventually executes, and the resulting change persists across restarts rather than being cleared on reboot.
The score needs a precondition attached. CVSS v3.1 lists the attack vector as network-reachable with no privileges required, but user interaction is required, meaning the malicious configuration still has to reach the client and be applied, not merely be transmitted at it. CISA rates the same flaw 9.4 out of 10 under the newer CVSS v4.0 scale, a difference of 0.2 that reflects how the two versions weigh scope change differently rather than any disagreement about severity.
The fix, and a compensating control that arrived first
IXON's advisory says the fix shipped in VPN Client version 1.4.7; versions below that remain vulnerable. Since Aug. 5, the day the advisory was published, IXON's cloud infrastructure has rejected connections from unpatched clients, a compensating control that blocks the exploit path for any device still checking in with IXON's cloud even before it is manually updated. Both CISA and IXON say they have no reports of the flaw being exploited.
The advisory landed in the same stretch of weeks as CISA fixes for three high-severity flaws in NextGen's Mirth Connect and a hard-coded cryptographic key in AVEVA's pipeline integrity software, part of a steady flow of industrial advisories that rarely reaches the audience that patches consumer software on a Tuesday schedule.
- IXON VPN Client9.6 CVSS v3.1 score
- Orthanc DICOM Server8.1 CVSS v3.1 score
- CareCam Pro IP Cameras6.8 CVSS v3.1 score
Source: CISA ICS and ICS-medical advisories, accessed 2026-09-11
Operators who cannot update immediately should not rely on the cloud-side block alone, since it only covers clients that reach IXON's cloud in the first place. IXON's own guidance for anyone who no longer needs remote access is blunter than a patch note: uninstall the client.
Sources
More in Security
- 01Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreOne flaw needs no password and no user interaction, the other needs an attacker already logged in, and CISA gave federal agencies the same three days to fix both.
- 02Bransys ELD App Shipped With Hardcoded Login CredentialsCISA disclosed three flaws Sept. 17 in the trucking compliance app, including a hardcoded password a researcher says exposed live location and engine data from every connected truck on a subset of fleets.
- 03MikroTik Patches RouterOS Flaws Attackers Exploited FirstPoland's national CERT says attackers began exploiting the chained flaws on Sept. 2, a day before MikroTik shipped a fix, and more than 122,500 routers were still reachable a week later.
- 04Attackers Exploit a JFrog Artifactory Bug in Four DayswatchTowr says attackers began minting administrator tokens by abusing a default empty join key, CVE-2026-82329, within days of JFrog's own patch shipping.