A recent security assessment by Shelltrail has revealed three major vulnerabilities in the IXON VPN client, which could allow attackers to gain unauthorized privileges on both Windows and Linux systems.
The vulnerabilities, identified as CVE-2025-ZZZ-01, CVE-2025-ZZZ-02, and CVE-2025-ZZZ-03, could lead to local privilege escalation (LPE) attacks. One of the flaws may have additional impacts, though these details are not yet disclosed.
The CVE identifiers are still pending due to funding issues and a backlog at MITRE, but updates will be provided once they are assigned.
IXON is a Dutch company that provides industrial remote access solutions. Their VPN service is cloud-based and requires a physical device connected either via Ethernet or mobile data.
