Critical flaws in the IXON VPN Client allow local attackers to escalate their privileges to system-level access across multiple platforms, including Windows, Linux, and macOS.
Identified under CVE-2025-26168 and CVE-2025-26169, these vulnerabilities impact versions earlier than 1.4.4. By exploiting these issues, unauthorized users could gain full control over compromised systems using an advanced technique involving the manipulation of temporary files.
IXON, a Dutch company specializing in remote access solutions for industrial environments, provides cloud-based VPN services that are commonly utilized in industrial systems and operational technology settings.
The Vulnerabilities in IXON VPN Client
Discovered by cybersecurity professionals Andreas Vikerup and Dan Rosenqvist of Shelltrail during a routine security review, these vulnerabilities target flaws in the IXON VPN client’s handling of configuration files. With a CVSS score of 8.1 (High), these vulnerabilities present a significant risk.
Exploitation on Windows Systems (CVE-2025-26169)
For Windows users, the attack exploits a race condition in the C:\Windows\Temp directory, where the VPN client temporarily stores its configuration files.
In this scenario, attackers with limited privileges can exploit the flaw to repeatedly overwrite the temporary configuration file with harmful content via PowerShell. As the VPN client operates with NT Authority\SYSTEM privileges, this manipulation allows attackers to execute arbitrary code at the highest system level once the modified configuration file is processed.
Exploitation on Linux Systems (CVE-2025-26168)
On Linux systems, the flaw targets the /tmp/vpn_client_openvpn_configuration.ovpn file located in a world-writable directory.
By using the mkfifo command to create a named pipe (FIFO) at this location, attackers can inject a malicious OpenVPN configuration. This configuration may include dangerous directives, such as tls-verify with script-security 2, allowing the execution of root-level code. When the IXON VPN Client processes the altered configuration, it runs the attacker’s code with root privileges, granting full control over the system.
| CVE | Affected Products | Impact | Exploit Prerequisites | CVSS 3.1 Score |
|---|---|---|---|---|
| CVE-2025-26168 | IXON VPN Client (Linux/macOS, ≤v1.4.3) | Local Privilege Escalation to root | Local access; Ability to manipulate /tmp/vpn_client_openvpn_configuration.ovpn | 8.1 (High) |
| CVE-2025-26169 | IXON VPN Client (Windows, ≤v1.4.3) | Local Privilege Escalation to SYSTEM | Local access; Exploitation of race condition in C:\Windows\Temp directory | 8.1 (High) |
Security Update Released
IXON has issued version 1.4.4 of its VPN client to mitigate the identified security vulnerabilities. This update strengthens the storage mechanisms for configuration files, ensuring that access is restricted to users with elevated privileges only.
To enhance security, experts recommend that organizations utilizing the IXON VPN Client immediately take the following actions:
- Upgrade to version 1.4.4 or later via the official IXON cloud portal.
- Confirm that the patch has been successfully applied by verifying the client version in the portal.
- Evaluate and implement additional access controls for critical systems.
- Continuously monitor systems for any indications of compromise or unauthorized activity.
For optimal protection, users are strongly urged to update to the latest version, confirm proper installation, and refrain from using vulnerable versions to safeguard their networks and vital assets.
