{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "CRITICAL"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "The Lenze VPN client is vulnerable to a Remote Code Execution. The vulnerability would allow an attacker to perform a remote code execution on the computer running the client with elevated privileges.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Please refer to the Lenze Cyber Security Documentation https://www.lenze.com/de-de/application-knowledge-base/artikel/312721/0 for further details.",
        "title": "General Recommendations"
      },
      {
        "category": "legal_disclaimer",
        "text": "Lenze SE assumes no liability whatsoever for any kind of losses or consequential losses that occur by the distribution and/or use of this document. All information published in this document is provided on good faith by Lenze SE. Insofar as permissible by law, however, none of this information shall establish any guarantee, commitment or liability on the part of Lenze SE. Lenze SE reserves the right to change or update this document at any time.",
        "title": "Disclamer"
      },
      {
        "category": "description",
        "text": "Update the Lenze VPN Client to the latest software Version (\u003e= 1.4.7). For further instructions, see the vendor fix for this vulnerability.\n",
        "title": "Remidiation"
      },
      {
        "category": "description",
        "text": "As the cloud environment blocks older versions of the Lenze VPN Client, you must update the Lenze VPN Client. If you attempt to connect to the VPN using an older version, an error message will appear stating: \"A newer version of the VPN client is required.\"",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "By exploiting this vulnerability, an attacker could completely compromise the system.",
        "title": "Impact"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@lenze.com",
      "name": "Lenze SE",
      "namespace": "https://www.lenze.com"
    },
    "references": [
      {
        "category": "external",
        "summary": "Lenze SE has a Product Security Incident Response Team (PSIRT) with its own communication channel. Contact us via https://www.lenze.com/ and the Service and Cyber Security tab.",
        "url": "https://www.lenze.com/en-de/services/cyber-security"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Lenze",
        "url": "https://certvde.com/en/advisories/vendor/lenze/"
      },
      {
        "category": "self",
        "summary": "VDE-2026-089: Lenze: VPN Client Remote Code Execution in combination with Lenze x500 IoT Gateway - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2026-089"
      },
      {
        "category": "self",
        "summary": "VDE-2026-089: Lenze: VPN Client Remote Code Execution in combination with Lenze x500 IoT Gateway - CSAF",
        "url": "https://lenze.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-089.json"
      }
    ],
    "title": "Lenze: VPN Client Remote Code Execution in combination with Lenze x500 IoT Gateway",
    "tracking": {
      "aliases": [
        "VDE-2026-089"
      ],
      "current_release_date": "2026-09-21T16:00:00.000Z",
      "generator": {
        "date": "2026-09-21T09:25:01.009Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.12"
        }
      },
      "id": "VDE-2026-089",
      "initial_release_date": "2026-09-21T16:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-09-21T16:00:00.000Z",
          "number": "1.0.0",
          "summary": "initial revision"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:semver/\u003e=1.0.0|\u003c1.4.7",
                    "product": {
                      "name": "Lenze VPN Client \u003c1.4.7",
                      "product_id": "CSAFPID-51001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:lenze:vpnclient:*:*:*:*:*:*:*:*"
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "1.4.7",
                    "product": {
                      "name": "Lenze VPN Client 1.4.7",
                      "product_id": "CSAFPID-52001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:lenze:vpnclient:1.4.7:*:*:*:*:*:*:*"
                      }
                    }
                  }
                ],
                "category": "product_family",
                "name": "Lenze VPN Client"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Lenze"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Luuk van Rheden"
          ],
          "organization": "IXON"
        }
      ],
      "cve": "CVE-2026-75925",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester. The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001"
        ],
        "known_affected": [
          "CSAFPID-51001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - 9.6 / Critical",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The Lenze VPN Client is available and downloadable via the Fleet Manager. Please update this Client. Obtain the update software (version \u003e= 1.4.7) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system:\n```\ntar -xzf vpn_client_x64.tar.gz\ncd vpn_client_x64\nsudo ./install\n```",
          "product_ids": [
            "CSAFPID-51001"
          ]
        },
        {
          "category": "mitigation",
          "details": "As the cloud environment blocks older versions of the Lenze VPN Client, you must update the Lenze VPN Client. If you attempt to connect to the VPN using an older version, an error message will appear stating: \"A newer version of the VPN client is required.\"",
          "product_ids": [
            "CSAFPID-51001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001"
          ]
        }
      ],
      "title": "IXON VPN Client CRLF Injection"
    }
  ]
}