External risk intelligence

IXON VPN Client CRLF Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-75925

The vulnerability affects a VPN client installed on end-user systems. While VPN clients interface with network traffic, they are typically host-based software rather than public-facing edge services, gateways, or internet-accessible appliances, making common, direct public-internet exposure of the vulnerable configuration interface unlikely.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the IXON VPN Client, a technology used for remote access. The flaw could allow an unauthenticated attacker to execute commands with elevated privileges on affected systems. The vulnerability may not be immediately apparent as it does not alter the VPN's functionality or user experience.

A security flaw allows unauthorized command execution.
This issue impacts remote access technology.
Confirm relevance and exposure to sensitive systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network requests to the IXON VPN client. Because the configuration interface does not require authentication or verification, an attacker could introduce malicious commands disguised as line endings into configuration files. These commands would then be executed with root or SYSTEM privileges when a privileged subprocess processes the configuration, potentially leading to full system compromise.

No authentication needed for attack.
Attackers inject commands via configuration.
Risk of full system takeover.

Live Threat

Current exploitation, exposure, and threat context

An attacker could inject malicious directives into configuration files by exploiting improper handling of line endings in the IXON VPN Client, potentially leading to unauthorized command execution with elevated privileges on affected systems. This could occur when an unauthenticated request modifies the client's configuration, and the changes persist across system restarts without visible indication to the user.

Arbitrary command execution.
Unauthenticated configuration changes.
Privileged access on the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

The IXON VPN client's improper handling of CRLF sequences requires immediate attention from teams responsible for endpoint security and application management. The first practical step is to identify all systems running the affected client, confirm their exposure, and determine the ownership of those assets before planning remediation.

Identify asset owners and prioritize remediation.
Verify client deployment and network exposure.
Coordinate vendor response and patch deployment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the IXON VPN Client?

The IXON VPN Client is software designed to facilitate secure remote access to industrial or enterprise networks. Users typically install it on workstations or servers to create encrypted tunnels for remote connectivity. Because it manages secure connections, it interacts with configuration files that control how the application communicates and manages its underlying system privileges.

What does CVE-2026-75925 mean by CRLF injection?

This CVE involves a weakness classified as CWE-93, where the software fails to properly neutralize CRLF (carriage return and line feed) sequences. In this specific case, an attacker can input these special characters to trick the application into adding unauthorized instructions to a configuration file. Because the system later treats these injected lines as legitimate commands, it inadvertently executes them with full root or SYSTEM-level permissions.

How is this IXON VPN vulnerability triggered?

The vulnerability is triggered when the application's configuration interface receives a specially crafted request. Since the interface lacks authentication or origin verification, it accepts these requests from unauthorized parties. Notably, the vulnerability is not triggered by standard VPN usage or traffic passing through the tunnel; it specifically requires interactions with the unprotected configuration interface.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that this vulnerability impacts host-based software rather than public-facing appliances. While theoretically reachable over a network, direct exposure to the internet is considered unlikely for this specific configuration interface. You should focus on systems where this client is installed, keeping in mind that internal network access might still be a factor for an attacker attempting to reach the service.

When should I prioritize addressing this CVE?

You should act immediately by locating all endpoints within your environment that run the IXON VPN Client. Because this flaw allows for full system compromise without any visible signs—such as connection drops or interface errors—you cannot rely on standard performance monitoring to detect it. Start by identifying the assets, confirming which systems are running versions prior to 1.4.7, and coordinating a plan to apply the vendor-supplied update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.