Read the docs
TI-2025-00606 Aliases CVE-2025-0714GHSA-m328-qqmc-777w

Insecure storage of sensitive information in MobaXTerm <25.0.

Priority LOW 28CWE-1204Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) consisting only of zero bytes and a master key to encrypt each password individually. In the default configuration, on opening MobaXTerm, the user is prompted for their password. A derivative of the password is used as the master key. As both the master key and the IV are the same for each stored password, the AES CFB ciphertext depends only on the plaintext (the password). The static IV and master key make it easier to obtain sensitive information and to decrypt data when it is stored at rest.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00164 5th percentileScored 2026-11-07
Fix Fixed MobaXterm (Mobatek): 25.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MobatekMobaXtermbefore 25.025.0Patch availableCNA
  • MobaXterm VendorMobatek Affected before 25.0 Fixed in 25.0 Patch available CNA

Remediation

  • Fix · CNA MobaXterm (Mobatek) Fixed in 25.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-0714
  2. 2026-10-03 Alias added: GHSA-m328-qqmc-777w

References

Advisory 1

  • TI-2019-15791 Mobatek MobaXterm 12.1 Buffer Overflow via Sessions File CVSS 4.0CRITICAL 9.3
  • TI-2022-17979 An access control issue in MobaXterm before v22.1 allows attackers to make connections to… CVSS 3.1HIGH 8.1
  • TI-2022-17980 When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the… CVSS 3.1CRITICAL 9.1
  • TI-2017-11289 The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which… CVSS 3.1CRITICAL 9.8
  • TI-2019-12274 In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. CVSS 3.1HIGH 8.8
  • TI-2019-05419 In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its… CVSS 3.0CRITICAL 9.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences