CVE-2025-0714
MEDIUM EPSS 4.9%
Published Feb 17, 20251y ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Published Feb 17, 2025 1y ago
Last Modified Jun 17, 2026 2w ago
Description
The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) consisting only of zero bytes and a master key to encrypt each password individually. In the default configuration, on opening MobaXTerm, the user is prompted for their password. A derivative of the password is used as the master key. As both the master key and the IV are the same for each stored password, the AES CFB ciphertext depends only on the plaintext (the password). The static IV and master key make it easier to obtain sensitive information and to decrypt data when it is stored at rest.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality High
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
4.9% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-1204
References 1
- cirosec.de https://www.cirosec.de/sa/sa-2024-012
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.