Lenze: VPN Client Privilege Escalation in combination with Lenze x500 IoT Gateway
The Lenze VPN client is vulnerable to a Local Privilege Escalation to root/SYSTEM by executing a configuration file which can be controlled by a non-privileged user. This occurs through a race condition exploit, where an attacker can overwrite the temporary OpenVPN configuration file located in a world-writable directory. By injecting malicious commands into the configuration file prior to its execution by the VPN client, an attacker can trigger arbitrary code execution with root/system privileges when a VPN connection is initiated. The vulnerability has been remediated in the version 1.4.4 of the Lenze VPN client. Due to some further developments and completion of the functional scope, it is recommended to update the firmware of the x500 IoT Gateway devices immediately, regardless of the current security vulnerability in the VPN client.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-26169US | — | — | ||
IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration file that can be controlled by a low-privil… | ||||
| CVE-2025-26168US | — | — | ||
IXON VPN Client before 1.4.4 on Linux and macOS allows Local Privilege Escalation to root because there is code execution from a configuration file that can be controlled by a low-… | ||||
references
External citations — patches, advisories, analysis.
- VDE-2025-042: Lenze: VPN Client Privilege Escalation in combination with Lenze x500 IoT Gateway - HTMLself
- CERT@VDE Security Advisories for Lenzeexternal
- VDE-2025-042: Lenze: VPN Client Privilege Escalation in combination with Lenze x500 IoT Gateway - CSAFself
- Lenze SE Product Security Incident Response Team (PSIRT)external
remediations (8)
- FixedLenze VPN Client <1.4.4 external component of Firmware x510 vers:all/* installed on x510
Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install
- FixedLenze VPN Client <1.4.4 external component of Firmware x510 vers:all/* installed on x510
Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install
- FixedLenze VPN Client <1.4.4 external component of Firmware x520 vers:all/* installed on x520
Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install
- FixedLenze VPN Client <1.4.4 external component of Firmware x520 vers:all/* installed on x520
Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install
- FixedLenze VPN Client <1.4.4 external component of Firmware x530 vers:all/* installed on x530
Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install
- FixedLenze VPN Client <1.4.4 external component of Firmware x530 vers:all/* installed on x530
Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install
- FixedLenze VPN Client <1.4.4 external component of Firmware x540 vers:all/* installed on x540
Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install
- FixedLenze VPN Client <1.4.4 external component of Firmware x540 vers:all/* installed on x540
Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan