CVE-2026-75925— IXON VPN Client CRLF Injection
Quick assessment
Affected
IXON IXON VPN Client
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 1.4.7 版本之前的 IXON VPN 客户端中，由于未对 CRLF（回车换行）序列进行适当中和处理，攻击者得以以 root 或 SYSTEM 权限执行命令。本地服务接受的配置值会被写入一个文件，该文件随后由具有更高权限的子进程读取并使用，但在写入过程中未对行尾序列进行中和处理，从而允许向该文件中注入额外的指令。配置接口在接收更改时，未对请求方的身份进行认证或验证其来源。所注入的配置会持久化保存在磁盘上，即使客户端或操作系统重启后依然存在，且 VPN 连接仍可正常工作，因此用户界面和行为上不会出现可见的变化。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75925
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IXON VPN Client CRLF Injection
Source: CVE Program / CVE List V5
Vulnerability Description
Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester. The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对CRLF序列的转义处理不恰当(CRLF注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IXON | IXON VPN Client | 0 ~ 1.4.7 | - |
|
II. Public POCs for CVE-2026-75925
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75925
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-75925 (3)
IV. Related Vulnerabilities
Same weakness: CWE-93
-
CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP -
CVE-2026-84962
Authenticated KMS request forgery via CRLF injection in GCP -
CVE-2026-84379
HTTPX2: Multipart part header injection via unvalidated file -
CVE-2026-84372
Predis: Redis command injection and denial of service via CR -
CVE-2026-82854
Nodemailer before 8.0.3 SMTP Command Injection via envelope.
V. Comments for CVE-2026-75925
No comments yet