IXON VPN Client Vulnerability (CVE-2025-26169): Local Privilege Escalation via Race Condition

A critical vulnerability (CVE-2025-26169) in IXON VPN Client versions prior to 1.4.4 allows local privilege escalation (LPE) to SYSTEM on Windows systems. The flaw stems from a race condition in world-writable temporary configuration files, enabling low-privileged users to execute arbitrary code with elevated permissions. This vulnerability, rated 8.1 (HIGH) on the CVSS scale, was disclosed on May 7, 2025, and patched in version 1.4.4¹.

Technical Analysis

The vulnerability occurs when the IXON VPN Client writes temporary configuration files to a globally writable directory without proper access controls or atomic operations. Attackers can exploit this by replacing the file contents during the brief window between creation and execution. Shelltrail researchers published a proof-of-concept demonstrating SYSTEM-level command execution through this race condition².

Additional related vulnerabilities were found in the same product:

CVE-2025-ZZZ-02: Linux privilege escalation via predictable OpenVPN configuration path
CVE-2025-ZZZ-03: Windows SYSTEM execution through C:\Windows\Temp race condition

All three flaws were addressed in version 1.4.4².

Exploitation Details

The Linux variant (CVE-2025-ZZZ-02) allows privilege escalation through OpenVPN configuration injection. Researchers demonstrated this using a FIFO file and malicious OpenVPN directives:

mkfifo /tmp/vpn_client_openvpn_configuration.ovpn
echo 'tls-verify "/bin/sh -c \"/usr/bin/id > /tmp/pwned\""' > /tmp/config.ovpn &
cat /tmp/config.ovpn > /tmp/vpn_client_openvpn_configuration.ovpn

This technique executes arbitrary commands during the OpenVPN connection process, with the commands running as root².

Impact and Mitigation

Successful exploitation leads to complete system compromise. Organizations using IXON VPN Client should immediately upgrade to version 1.4.4 or later. For systems where immediate patching isn’t possible, the following temporary measures can reduce risk:

Mitigation	Effectiveness
Restrict write permissions to temporary directories	High
Monitor for suspicious process creation from VPN client	Medium
Implement application allowlisting	Medium

Balbix recommends prioritizing patching for vulnerabilities with known exploitation paths and high CVSS scores³.

Conclusion

CVE-2025-26169 represents a significant risk to organizations using vulnerable versions of IXON VPN Client. The combination of local privilege escalation and remote code execution capabilities makes this vulnerability particularly dangerous in multi-user environments. The availability of public proof-of-concepts increases the likelihood of widespread exploitation. Immediate patching remains the most effective defense against potential attacks leveraging this vulnerability.