CVE-2026-75925 is a CRLF-injection vulnerability in the IXON VPN Client, software used to give remote-access connections to industrial equipment: because the client accepts unauthenticated configuration changes and does not sanitize line-ending characters, an attacker can inject extra directives into files that privileged processes later read, achieving root or SYSTEM code execution that persists across restarts; NVD has not, as of 2026-10-31, completed its own CVSS scoring.
Vulnerability summary
CVSS base score
N/A
No NVD score published as of
EPSS score (FIRST)
0.7%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
No
Not listed
Published
Vulnerability ID: CVE-2026-75925 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| IXON VPN Client | — | < 1.4.7 (fixed in 1.4.7) |
What does this mean for affected devices?
CVE-2026-75925 is an Improper Neutralization of CRLF Sequences vulnerability (CWE-93) in the IXON VPN Client versions before 1.4.7. IXON's client is deployed to give field engineers and vendors remote-access connectivity into industrial equipment and control systems. CISA's advisory describes the flaw as allowing attackers to "execute commands as root or SYSTEM" because the client "accepts configuration changes without authentication, and these persist across restarts," with the injected CRLF sequences letting an attacker smuggle additional directives into configuration files that privileged subprocesses subsequently parse and act on (CISA ICS Advisory ICSA-26-246-02).
NVD tracks CVE-2026-75925 with status "Awaiting Analysis" as of 2026-10-31: it has recorded a CISA-ADP-submitted score — CVSS v3.1 9.6 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, and CVSS v4.0 9.4 (critical) — both attributed to source [email protected] and typed Secondary, not an NVD-confirmed Primary rating, so this page does not show a headline severity score (NVD).
CISA's advisory, published 2026-09-03, lists the affected sectors as Commercial Facilities, Critical Manufacturing, Energy, Information Technology, and Water and Wastewater Systems, with worldwide deployment; IXON is headquartered in the Netherlands (CISA ICS Advisory ICSA-26-246-02).
IXON's own security bulletin, ADV-2026-08-05, confirms the remote-code-execution impact and ties the fix to CVE-2026-75925 and CISA advisory ICSA-26-246-02, directing customers to update affected VPN Client installations and consult IXON's support documentation (IXON Security Advisory ADV-2026-08-05).
IXON has shipped VPN Client 1.4.7 to fix the issue, and as an additional backstop, "IXON cloud has rejected connections from unpatched clients since August 5, 2026" — meaning any client still below 1.4.7 can no longer reach IXON's cloud service at all, which limits (but for already-compromised local hosts does not eliminate) the exposure window for stragglers (CISA ICS Advisory ICSA-26-246-02).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-30, and FIRST scores the probability of exploitation at 0.00671 (52.0th percentile) as of 2026-10-30 — the highest in this batch, consistent with a client-side RCE affecting software widely deployed for third-party remote access into OT environments (CISA KEV, FIRST EPSS).
Organizations running the IXON VPN Client should update to 1.4.7 or later immediately, and uninstall the client entirely on any host where remote access is no longer required.
Evidence
- IXON VPN Client accepts unauthenticated configuration changes that persist across restarts; failure to sanitize CRLF sequences lets an attacker inject directives executed as root or SYSTEM (CWE-93). — CISA ICS Advisory ICSA-26-246-02
- NVD status is "Awaiting Analysis" with CISA-ADP-submitted ([email protected]) Secondary CVSS v3.1 9.6 / v4.0 9.4, no NVD-published Primary score as of 2026-10-31. — NVD
- Affects Commercial Facilities, Critical Manufacturing, Energy, IT, and Water/Wastewater sectors worldwide; IXON is Netherlands-based; fixed in VPN Client 1.4.7; IXON cloud has rejected connections from unpatched clients since 2026-08-05. — CISA ICS Advisory ICSA-26-246-02
- IXON's own security bulletin ADV-2026-08-05 confirms the RCE and ties it to CVE-2026-75925 / ICSA-26-246-02, directing customers to update. — IXON Security Advisory ADV-2026-08-05
- Not present in the CISA KEV catalog as of 2026-10-30; EPSS score is 0.00671 (52.0th percentile) as of 2026-10-30. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
What is CVE-2026-75925?
CVE-2026-75925 is a CRLF-injection vulnerability in the IXON VPN Client, software used to give remote-access connections to industrial equipment: because the client accepts unauthenticated configuration changes and does not sanitize line-ending characters, an attacker can inject extra directives into files that privileged processes later read, achieving root or SYSTEM code execution that persists across restarts; NVD has not, as of 2026-10-31, completed its own CVSS scoring.
How severe is CVE-2026-75925?
CVE-2026-75925 has no NVD CVSS score published as of 2026-11-10, so this page gives it no severity rating rather than assuming low or high risk.
Is CVE-2026-75925 being actively exploited?
CVE-2026-75925 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. FIRST's EPSS model puts its probability of exploitation at 0.67%.
What is affected by CVE-2026-75925?
CVE-2026-75925 affects IXON VPN Client.
Where does this CVE-2026-75925 information come from?
This advisory is based on NVD, CISA ICS Advisory ICSA-26-246-02, IXON Security Advisory ADV-2026-08-05, CISA KEV, and FIRST EPSS, cited in full in the Sources section above.
Questions about this page?