CVE-2025-0714mediumCWE-1204

CVE-2025-0714: fallo de gravedad media en Mobatek MobaXterm

Insecure storage of sensitive information in MobaXTerm <25.0.

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear MobaXterm

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.2%
The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) consisting only of zero bytes and a master key to encrypt each password individually. In the default configuration, on opening MobaXTerm, the user is prompted for their password. A derivative of the password is used as the master key. As both the master key and the IV are the same for each stored password, the AES CFB ciphertext depends only on the plaintext (the password). The static IV and master key make it easier to obtain sensitive information and to decrypt data when it is stored at rest.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Productos afectados
Mobatek · MobaXterm
CVEs relacionadas — Mobatek MobaXterm

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-25866HIGHMobaXterm < 26.1 Notepad++ Unquoted Service PathEPSS 0.1%CVE-2026-112161HIGHLack of integrity checks in Mobatek’s MobaXtermEPSS 0.1%