Vulnerability in Mobatek Mobaxterm
CVE-2025-0714
The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) consisting only of zero bytes and a master key to encrypt each password individually. In the default configuration, on opening MobaXTerm, the user is prompted for their password. A derivative of the password is used as the master key. As both the master key and the IV are the same for each stored password, the AES CFB ciphertext depends only on the plaintext (the password). The static IV and master key make it easier to obtain sensitive information and to decrypt data when it is stored at rest.
EPSS: 0.002 (5.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Mobatek Mobaxterm — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- a341c0d1-ebf7-493f-a84e-38cf86618674 (third-party-advisory)
Frequently asked questions
- What is CVE-2025-0714?
- CVE-2025-0714 is a medium-severity vulnerability in Mobatek Mobaxterm, classified under CWE-1204. CVSS score: 6.5/10. Published 2025-02-17.
- How severe is CVE-2025-0714?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2025-0714 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.