IXON VPN Client before 1.4.4: local privilege escalation to root and SYSTEM, and why 'local only' is cold comfort

Industrial remote access has a weak point that is easy to miss: the computer running the client. IXON VPN Client makes that point hard to ignore. Versions before 1.4.4 carry two NVD-tracked local privilege escalation flaws (CVE-2025-26168 on Linux and macOS, CVE-2025-26169 on Windows) that can take a low-privileged user to root or SYSTEM through a race condition in which a temporary configuration file in a world-writable directory can be overwritten CVE-2025-26168 (NVD)(https://nvd.nist.gov/vuln/detail/CVE-2025-26169). The attack starts locally. In an operational setting, that can be exactly where untrusted code is present.

Field Circuit's read: in industrial remote access, the security boundary is not the encrypted tunnel and it is not the router bolted to the machine. It is the VPN client process that a local attacker can push to root or SYSTEM. According to IXON's documentation, the client is a lightweight background service or daemon that establishes secure connections to IXrouter and IXagent devices How to use the VPN Client API(https://support.ixon.cloud/s/article/VPN-Client-installation-and-uninstallation). It also runs a local web server on port 9250 so the IXON Cloud portal can send it connect requests How to use the VPN Client API. That design gives an always-on piece of software a local attack surface no machine-room firewall can see, and the two CVEs let a local attacker turn that surface into root or SYSTEM. The two flaws share a usefully ugly mechanism: the client executes code from a configuration file that a low-privileged user can control, in a race condition where a temporary configuration file in a world-writable directory can be overwritten CVE-2025-26168 (NVD)(https://nvd.nist.gov/vuln/detail/CVE-2025-26169). CISA advisory ICSA-26-246-02 also addresses the IXON VPN Client IXON VPN Client.

The common defence is “these are local vulnerabilities.” True. The CVEs do not arrive over the tunnel; an attacker needs a local foothold on the PC, at minimum a low-privileged account that can influence the client's configuration. But the precondition is not exotic. Where the client runs on a general-purpose PC (the same machine used for email, web browsing, file transfers and USB drives), a low-privileged account can trigger the race. Any malware that has already infected the PC, or any untrusted code that arrives on it, can do the same. And the escalation ends at root or SYSTEM, the top of the machine CVE-2025-26168 (NVD)(https://nvd.nist.gov/vuln/detail/CVE-2025-26169). The “local only” framing sounds like a limitation. In practice, it describes the client's own deployment environment.

The strongest counterargument is that a locked-down, single-user PC with no untrusted code is not materially at risk; these CVEs do not expose the VPN tunnel to the internet. That is fair, and it narrows the thesis: not every installation is exposed. What it does not do is save the deployment where the client sits on a general-purpose PC. Once an attacker has root or SYSTEM on that path, they can, in principle, use the client's local web server to direct it toward IXrouter and IXagent devices on the other side How to use the VPN Client API. The tunnel is not the boundary. The PC is.

The operating consequence follows directly. If you have IXON VPN Client on any PC, check the installed version now. For the NVD-tracked flaws, the fixed line is 1.4.4 or later CVE-2025-26168 (NVD)(https://nvd.nist.gov/vuln/detail/CVE-2025-26169). Treat that PC as OT equipment, not general-purpose office kit. That means no casual web browsing, no untrusted USB drives, no shared admin logins, and local endpoint monitoring that can see which processes connect to port 9250 How to use the VPN Client API. If the client is configured as a Windows service with SYSTEM privileges, ask why; a least-privilege service account or a dedicated jump host reduces the value of the escalation. The cost of one compromised remote-access laptop is not the laptop. It is the process network behind it.

The available evidence does not confirm whether South African operators are running vulnerable versions. That absence is not a reason to skip the check; it is the reason to do the inventory. The risk is conditional: if a vulnerable client is installed on a PC attached to the network, the exposure is real.

Watch next: IXON's patch guidance, vendor confirmation of the fixed version, and any reports of these client-side flaws being used as a practical pivot into OT. The larger tell is architectural. A VPN client that can be pushed to root or SYSTEM, that exposes a local web server, and that writes temporary configuration files to a world-writable directory is a bridge that no tunnel can protect. Until vendors put the client on the same security diet as the router, a tunnel is only as trustworthy as the least defended PC running the client.