Loading today’s stories
Security1 distinct publisher3 min readPublished
CVE-2026-75925 lets anything that reaches the client's local configuration interface plant directives in a file a privileged subprocess later runs. Since 5 August 2026 IXON's cloud has refused clients below 1.4.7, which is what actually breaks the chain.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
Follow any of these and your For You feed starts watching them — no settings page required.
security
Siemens IoT2050 gateways ship a Node-RED interface that asks nobody for a password1 distinct publisher
security
One malformed CIP message faults a Logix controller until someone power-cycles it1 distinct publisher
security
CISA's Ebyte advisory carries no fixed version, because the vendor stopped answering1 distinct publisher
security
ASE2000's IEC 104 client accepts a forged peer certificate through version 2.371 distinct publisher
The write and the execution do not happen at the same moment. Directives land in a configuration file that the local service accepts values for, and the privileged subprocess that consumes that file is created when the client connects [3][7]. That separation is why the injection survives a reboot of the client and of the operating system, and why the tunnel keeps carrying traffic normally while it does [5].
The origin check is the other half. According to CISA, the configuration interface accepts changes without authenticating or verifying the origin of the requester, logged as CWE-306 contributing [4]. Any process on the box qualifies, as does anything else able to reach that local interface. On its own, either defect would be a routine bug report. Combined, they give an unauthenticated caller escalation to root or SYSTEM on the machine that holds the OT tunnel [2][1].
The remediation list has three entries: update to 1.4.7 or later on every computer where the client is installed, IXON cloud rejecting older clients, and uninstalling the client if it is no longer needed [8][6][9]. None of them describes removing directives already written to disk [2]. For any host that was injected before the cloud gate went up, patching closes the injection path and leaves the file. A fleet check that asks whether the tunnel is up returns clean on that host, because the advisory is explicit that there is no behavioral change visible to the user [5].
For estates where every client talks to IXON cloud, the exploit chain is already dead. The gate has been in place at both the portal and the back-end API since 5 August 2026, and the privileged subprocess and injected listener exist only once a client connects, so an unpatched client that cannot get past the portal cannot finish the chain [6][7]. That makes this a disk-inspection and inventory job rather than an emergency patch cycle. The work is finding the pre-1.4.7 installs nobody tracks: contractor laptops, decommissioned engineering workstations, images that still ship the client. CISA lists five critical infrastructure sectors and worldwide deployment, so the inventory question is not small even where the exploit is [3][12].
Provenance is worth naming. Luuk van Rheden of IXON found the flaw and Stan van Duijnhoven of IXON reported it to CISA [10]. The vendor discovered its own bug, shut the precondition off at its own service, and CISA reports no known public exploitation specifically targeting this vulnerability [6][11]. There is no third-party finder and no proof of concept in the advisory. What remains is the pattern: remote-access software sold to reach OT networks keeps producing the local privilege escalation that gets an attacker onto the box holding the credentials, and this time the fix took effect at the vendor's cloud gate, ahead of any customer's patch window.
Ranked by verification strength, evidence, and original report placement.
CISA's ICS advisory covers CVE-2026-75925 in IXON VPN Client, affecting versions before 1.4.7.
Improper Neutralization of CRLF Sequences (CWE-93) in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM; CISA's summary describes remote code execution on the computer running the client with elevated privileges.
Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess without line-ending sequences being neutralised, which allows additional directives to be introduced into that file.
The configuration interface accepts changes without authenticating or verifying the origin of the requester, listed as CWE-306 contributing.
The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user.
As of August 5, 2026, IXON cloud rejects connections from clients below v1.4.7 at both the portal and the back-end API.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · September 3, 2026
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
First-party detail, single account
The mechanism is described with unusual precision for an ICS advisory — values accepted, file written, privileged subprocess reads it, persistence across reboots — and that precision comes from the people who found the bug. The cost of that provenance is visible in the same document: the Metrics block is empty, so no severity score exists, and no file path, port, or reproduction detail is available anywhere to check the description against.
Blocked at the gate, uncounted at the edge
Mitigation uptake here is not something users had to do: IXON flipped a switch on its own cloud and old clients stopped connecting, which covers every install that calls home. What nobody has published is the other half — how many machines carry the client, how many now run 1.4.7, or how many sat exposed between the bug's existence and 5 August. Five sectors and 'worldwide' are the closest thing to a footprint on the record.
The persistence is the quiet part
Nothing here is inflated — root, reboot-surviving, invisible to the user is IXON's own phrasing, and CISA adds that no exploitation has been reported to it. The under-told part sits in the remediation list: update, cloud-side rejection, uninstall all stop the next attempt, while the file the advisory says survives reboots goes unmentioned. A reader who follows the instructions exactly does less than the described risk warrants.
Found, described, and graded in-house
Luuk van Rheden of IXON found it, Stan van Duijnhoven of IXON reported it, IXON wrote the technical description, and IXON supplied the assertion that its own cloud gate makes the chain uncompletable. CISA republishes; it does not test. That is a defensible disclosure route and also a closed loop — the claim doing the most work for customers' peace of mind is the one with no outside party positioned to check it.
Coherent, and impossible to check
The account holds together and comes from the party best placed to know, which earns it real weight. It stays short of high confidence for one reason: the connect-time argument that keeps unpatched installs safe is unverifiable from outside, and there is no second document, score, or researcher note to lean on if it turns out to be incomplete.