IXON VPN Client CRLF Injection

Answer in brief

CVE-2026-75925 records a Unknown severity vulnerability in IXON VPN Client CRLF Injection. The current sources do not mark it as known exploited. The current feed maps IXON/IXON VPN Client (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 4, 2026Updated Sep 4, 2026Source checked Sep 4, 2026First seen by HOL Sep 4, 2026Material review Sep 4, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps IXON/IXON VPN Client (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
IXON/IXON VPN Clientgeneric	>=0 <1.4.7	1.4.7

Recommended response

Check inventory. Check lockfiles and deployed manifests for IXON/IXON VPN Client.
Review the reported fix. Update IXON/IXON VPN Client to 1.4.7 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 4, 2026

Sources and claim methodology

Upstream source description

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester. The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user.

Quoted source text, attributed separately from HOL analysis.