Executive brief
IXON VPN Client is a remote access tool used to securely connect to networks and infrastructure. A flaw in how the client handles configuration data allows an attacker to inject malicious commands that execute with administrator or system privileges, potentially granting full control over the affected computer. The attack requires user interaction (connecting to the VPN) but leaves no visible trace of compromise, as the VPN continues to function normally.
Technical details
This vulnerability is a CRLF injection (CWE-93) combined with an authentication bypass (CWE-306). The VPN Client's local configuration service accepts configuration changes without authenticating the requester, writing unsanitized input to a file later read by a privileged subprocess. By injecting carriage return and line feed sequences, an attacker can insert arbitrary directives into the configuration file. The injected configuration persists across client and OS restarts, and the exploit chain only completes when the client connects to IXON's cloud service. As of August 2026, IXON cloud rejects unpatched clients below version 1.4.7, effectively blocking the exploit at the connection stage, though local injection remains possible. A patch is available in version 1.4.7 or later.
Affected products
- IXON VPN Client before 1.4.7
Timeline
- 2026-09-03: disclosed
- 2026-09-04: advisory