CVE-2025-26169

highpriority · track · 0EPSS 0.002 · 13 %ileDEEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.23% (13th) EPSS
CVSS 8.1 · high
Is it mine?
9 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · lenze_psirt

EPSS · scored 2026-10-27

IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration file that can be controlled by a low-privileged user. There is a race condition in which a temporary configuration file, in a world-writable directory, can be overwritten.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedLenze VPN Client <1.4.4 external component of Firmware x510 vers:all/* installed on x510lenze_psirt

    Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install

  • FixedLenze VPN Client <1.4.4 external component of Firmware x520 vers:all/* installed on x520lenze_psirt

    Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install

  • FixedLenze VPN Client <1.4.4 external component of Firmware x530 vers:all/* installed on x530lenze_psirt

    Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install

  • FixedLenze VPN Client <1.4.4 external component of Firmware x540 vers:all/* installed on x540lenze_psirt

    Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install

02

cvss

Technical severity, 0–10. One row per scoring source.

8.1
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.1highCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU
v3.18.1highCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · cve@mitre.org USexploitability 1.4 · impact 6
v3.18.1highCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · Lenze PSIRT DE
v3.17.4highCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-732USCWE-732US
05

affected products (9)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • VDE-2025-042Lenze: VPN Client Privilege Escalation in combination with Lenze x500 IoT Gateway2025-05-27csaf · lenze_psirtDE

    The Lenze VPN client is vulnerable to a Local Privilege Escalation to root/SYSTEM by executing a configuration file which can be controlled by a non-privileged user. This occurs through a race condition exploit, where an attacker can overwrite the temporary OpenVPN configuration file located in a world-writable directory. By injecting malicious commands into the configuration file prior to its execution by the VPN client, an attacker can trigger arbitrary code execution with root/system privileges when a VPN connection is initiated. The vulnerability has been remediated in the version 1.4.4 of the Lenze VPN client. Due to some further developments and completion of the functional scope, it is recommended to update the firmware of the x500 IoT Gateway devices immediately, regardless of the current security vulnerability in the VPN client.

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdlenze_psirtNVDCVE.orgMITRE
published 2025-05-07modified 2026-06-17
09

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan