Command Execution Vulnerability in IXON VPN Client by IXON

CVE-2026-75925

What is CVE-2026-75925?

The IXON VPN Client, prior to version 1.4.7, exhibits a vulnerability where improper handling of carriage return and line feed (CRLF) sequences allows attackers to execute arbitrary commands with elevated privileges. This occurs because configuration values provided to the local service are stored in a file that a privileged subprocess later reads. Without proper neutralization, malicious directives can be introduced into this file. Notably, there are no authentication checks on the configuration interface, enabling unauthorized changes. Additionally, any injected configurations can persist across client and system restarts, maintaining VPN functionality without visible indicators of compromise.

References