CVE-2026-75925: CWE-93 in IXON IXON VPN Client

The vulnerability in IXON VPN Client prior to version 1.4.7 arises from improper neutralization of CRLF sequences in configuration values accepted by a local service. These values are written to a file later processed by a privileged subprocess. Because line-ending sequences are not neutralized, attackers can inject additional directives into this file. The configuration interface accepts changes without authentication or verification, allowing unauthorized attackers to persistently inject commands that execute with root or SYSTEM privileges. The injected configuration remains on disk across client and OS restarts, and the VPN connection continues to operate normally, making the attack stealthy.

An attacker can execute arbitrary commands with root or SYSTEM privileges on the affected system by injecting malicious directives into configuration files. This can lead to full system compromise, data loss, or disruption of services. The vulnerability requires no privileges and can be triggered remotely with user interaction. The persistent nature of the injected configuration means the compromise survives reboots and remains undetected by normal user activity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the configuration interface to trusted users only and monitor for unauthorized configuration changes. Because the vulnerability involves unauthenticated configuration changes, controlling access to the local service is critical.