A recent investigation by Shelltrail has revealed three major security flaws within the IXON VPN client, posing serious risks of privilege escalation on both Windows and Linux platforms.

Tracked under provisional identifiers CVE-2025-ZZZ-01, CVE-2025-ZZZ-02, and CVE-2025-ZZZ-03, these vulnerabilities open the door to local privilege escalation (LPE) attacks, with an additional, undisclosed impact still under review.

While formal CVE assignments are delayed due to funding limitations and a backlog at MITRE, Shelltrail has confirmed that official updates will be provided as soon as they are issued.

IXON, a Netherlands-based company specializing in industrial remote access solutions, provides a cloud-driven VPN service that relies on a physical device linked through Ethernet or mobile networks.

Users connect to their environments by logging into the cloud portal at https://ixon.cloud, where they can initiate secure VPN tunnels to on-site networks.

To facilitate these connections, users must install the IXON VPN client — proprietary software available for download via the portal. This client operates a local web server on https://localhost:9250 and runs with elevated privileges: as a root-level systemd service on Linux systems and under the NT Authority\SYSTEM account on Windows machines.

Critical IXON VPN Vulnerabilities Uncovered: What You Need to Know

Overview of the Latest Findings

Shelltrail security researchers have uncovered several major security flaws in IXON’s VPN client, highlighting significant risks for industrial environments relying on remote connectivity. Here’s a breakdown of the latest vulnerabilities and how IXON is addressing them.

CVE-2025-ZZZ-01: Details Withheld for Now

One of the vulnerabilities (CVE-2025-ZZZ-01) remains under wraps for the time being. To prevent putting users at unnecessary risk, Shelltrail has chosen not to disclose specifics until IXON rolls out an official fix. Rest assured, IXON has been fully informed and is actively working toward remediation.

CVE-2025-ZZZ-02: Local Privilege Escalation on Linux

A critical flaw affecting Linux systems was identified, where the VPN client temporarily saves its OpenVPN configuration at a known and insecure location: /tmp/vpn_client_openvpn_configuration.ovpn.

Shelltrail’s team found that an attacker could leverage this by using the mkfifo command to place a malicious named pipe at that path. When the VPN client interacts with this pipe, it unknowingly pulls in a rogue OpenVPN configuration. With carefully crafted options like tls-verify and script-security 2, the attacker can execute code with root privileges.

One mitigating factor: the exploit requires the user to establish a live VPN connection to trigger the attack.

CVE-2025-ZZZ-03: Local Privilege Escalation on Windows

Windows users aren’t immune either. Shelltrail researchers demonstrated that the IXON VPN client stores its OpenVPN configuration file in C:\Windows\Temp, a directory freely accessible to non-privileged users.

By exploiting a race condition, an attacker can continually overwrite the temporary file with a malicious version via a simple PowerShell loop. Unlike the Linux exploit, this attack does not require an active VPN session, making it even more dangerous by allowing SYSTEM-level code execution with relative ease.

Root Cause: Poor File Handling

At the heart of both vulnerabilities is the way the IXON VPN client handles OpenVPN configurations during connection setup. When users connect, their browser communicates with a local web server, which in turn sends authentication and device data to IXON’s cloud portal. The portal responds with an OpenVPN config file — but the unsafe handling of that file on disk opened the door to privilege escalation.

IXON’s Response and Recommendations

IXON moved quickly to address these threats. In version 1.4.4 of the VPN client, they have:

• Reworked file storage to restrict access to high-privilege users only.
• Eliminated insecure file paths vulnerable to manipulation.

Meanwhile, work continues on a patch for the undisclosed vulnerability (CVE-2025-ZZZ-01).

Action Required:
If you’re running an earlier version, immediately update to version 1.4.4 or later. Full details and update instructions are available in IXON’s official advisory (ADV-2025-03-17) at https://support.ixon.cloud.

Industrial networks using IXON’s VPN are particularly exposed, given the high-value systems often connected via these clients. These discoveries serve as a critical reminder: even trusted remote access solutions need constant security validation.

Stay tuned for future updates as Shelltrail continues its mission to strengthen cybersecurity in industrial environments.