EUVD-2026-71776
GHSA-6x6j-jwcm-r3mg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated config interface (PR:N) reachable per vendor AV:N with passive interaction (UI:R); unprivileged input crosses into a root/SYSTEM subprocess (S:C) yielding full C/I/A:H.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
6DescriptionCVE.org
Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester. The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user.
AnalysisAI
Privilege escalation to root/SYSTEM in IXON VPN Client before 1.4.7 lets an attacker inject arbitrary configuration directives via a CRLF (improper neutralization, CWE-93) flaw: the client's local configuration interface accepts changes without authenticating or verifying the requester's origin, writes those values to a file, and a privileged subprocess later consumes them. By embedding line-ending sequences the attacker smuggles additional directives that run with elevated privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires reaching the IXON VPN Client's local configuration interface, which by design accepts configuration changes without authenticating or verifying the origin of the requester (no credentials needed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score is 9.4 (AV:N/AC:L/AT:N/PR:N/UI:P) with full high impact to both the vulnerable system (VC/VI/VA:H) and subsequent systems (SC/SI/SA:H), reflecting an unauthenticated path to root/SYSTEM code execution and stealthy persistence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade IXON VPN Client to version 1.4.7 or later on every host running the client, per IXON advisory ADV-2026-08-05 and CISA ICSA-26-246-02. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your environment to identify all systems running IXON VPN Client and document their versions; cross-reference with VPN access logs to determine who has client deployments and contact vendor IXON for patch availability status. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today