Windows Local Privilege Escalation On Windows, the VPN client similarly stores its OpenVPN configuration in C:\Windows\Temp, a directory where standard users can create files and folders with full permissions. Linux Local Privilege Escalation On Linux, the VPN client temporarily stores an OpenVPN configuration file in the predictable /tmp/vpn_client_openvpn_configuration.ovpn location. A recent security assessment by Shelltrail has uncovered three critical vulnerabilities in the IXON VPN client, potentially allowing attackers to escalate privileges on both Windows and Linux systems. The IXON VPN client, a proprietary software downloaded from the portal, is essential for connectivity and runs a local web server on operating as a root-level systemd service on Linux and as NT Authority\SYSTEM on Windows. Shelltrail researchers discovered that an attacker could stall the VPN client and inject a malicious OpenVPN configuration by creating a named pipe (FIFO) at this path using the mkfifo command. By exploiting a race condition, attackers can use a PowerShell script to repeatedly overwrite the temporary configuration file with a malicious version, achieving SYSTEM-level code execution. IXON has been commended for its prompt response, addressing the privilege escalation vulnerabilities in version 1.4.4 of the VPN client. This server forwards the request to appending local configuration details and receiving an OpenVPN configuration file. IXON, a Dutch provider of industrial remote access solutions, offers a cloud-based VPN service requiring a physical device connected via Ethernet or mobile data. Identified as CVE-2025-ZZZ-01, CVE-2025-ZZZ-02, and CVE-2025-ZZZ-03, these flaws expose users to local privilege escalation (LPE) risks, with one additional impact currently undisclosed. Details of this vulnerability remain confidential until IXON releases a public fix, as its exploitation could require significant configuration changes.
This Cyber News was published on cybersecuritynews.com. Publication date: Sun, 27 Apr 2025 10:40:07 +0000