Lenze: VPN Client Remote Code Execution in combination with Lenze x500 IoT Gateway
The Lenze VPN client is vulnerable to a Remote Code Execution. The vulnerability would allow an attacker to perform a remote code execution on the computer running the client with elevated privileges.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-75925US | — | — | ||
Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the loc… | ||||
references
External citations — patches, advisories, analysis.
- VDE-2026-089: Lenze: VPN Client Remote Code Execution in combination with Lenze x500 IoT Gateway - HTMLself
- CERT@VDE Security Advisories for Lenzeexternal
- VDE-2026-089: Lenze: VPN Client Remote Code Execution in combination with Lenze x500 IoT Gateway - CSAFself
- Lenze SE has a Product Security Incident Response Team (PSIRT) with its own communication channel. Contact us via https://www.lenze.com/ and the Service and Cyber Security tab.external
remediations (2)
- MitigationLenze VPN Client <1.4.7
As the cloud environment blocks older versions of the Lenze VPN Client, you must update the Lenze VPN Client. If you attempt to connect to the VPN using an older version, an error message will appear stating: "A newer version of the VPN client is required."
- FixedLenze VPN Client <1.4.7
The Lenze VPN Client is available and downloadable via the Fleet Manager. Please update this Client. Obtain the update software (version >= 1.4.7) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: ``` tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install ```
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan