CVE-2025-26169

highPriorität · verfolgen · 0EPSS 0.002 · 13. PerzentilDEEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.23% (13th) EPSS
CVSS 8.1 · high
Is it mine?
9 products
Prüfe deine Angriffsfläche
Who says so?
3 sources
cnnvd · enisa_euvd · lenze_psirt

EPSS · bewertet 2026-10-27

IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration file that can be controlled by a low-privileged user. There is a race condition in which a temporary configuration file, in a world-writable directory, can be overwritten.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenLenze VPN Client <1.4.4 external component of Firmware x510 vers:all/* installed on x510lenze_psirt

    Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install

  • BehobenLenze VPN Client <1.4.4 external component of Firmware x520 vers:all/* installed on x520lenze_psirt

    Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install

  • BehobenLenze VPN Client <1.4.4 external component of Firmware x530 vers:all/* installed on x530lenze_psirt

    Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install

  • BehobenLenze VPN Client <1.4.4 external component of Firmware x540 vers:all/* installed on x540lenze_psirt

    Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.1
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.1highCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU
v3.18.1highCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · cve@mitre.org USAusnutzbarkeit 1.4 · Auswirkung 6
v3.18.1highCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · Lenze PSIRT DE
v3.17.4highCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-732USCWE-732US
05

betroffene Produkte (9)

Betroffene Produkte und Versionsbereiche.

06

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

  • VDE-2025-042Lenze: VPN Client Privilege Escalation in combination with Lenze x500 IoT Gateway2025-05-27csaf · lenze_psirtDE

    The Lenze VPN client is vulnerable to a Local Privilege Escalation to root/SYSTEM by executing a configuration file which can be controlled by a non-privileged user. This occurs through a race condition exploit, where an attacker can overwrite the temporary OpenVPN configuration file located in a world-writable directory. By injecting malicious commands into the configuration file prior to its execution by the VPN client, an attacker can trigger arbitrary code execution with root/system privileges when a VPN connection is initiated. The vulnerability has been remediated in the version 1.4.4 of the Lenze VPN client. Due to some further developments and completion of the functional scope, it is recommended to update the firmware of the x500 IoT Gateway devices immediately, regardless of the current security vulnerability in the VPN client.

07

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdlenze_psirtNVDCVE.orgMITRE
veröffentlicht 2025-05-07geändert 2026-06-17
09

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan