Mobatek
8 CVEs across 4 Mobatek products. Browse Mobatek vulnerabilities, severities, and proof-of-concept exploits.
Mobatek products with known CVEs
Mobatek CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-11967 | | | 2026-06-12 | MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading a malicious DLL located in the same directo… |
CVE-2019-25741 | Critical | 9.8 | 2026-06-04 | Mobatek MobaXterm 12.1 contains a structured exception handling (SEH) based buffer overflow vulnerability in the username field of session files that allows re… |
CVE-2026-6421 | High | 7.0 | 2026-04-17 | A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to… |
CVE-2026-25866 | High | 7.8 | 2026-03-09 | MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully… |
CVE-2025-0714 | Medium | 6.5 | 2025-02-17 | The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) consisting only of… |
CVE-2022-38337 | Critical | 9.1 | 2022-12-06 | When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can… |
CVE-2022-38336 | High | 8.1 | 2022-12-06 | An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication. |
CVE-2021-28847 | High | 7.5 | 2021-06-03 | MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change requests that are sent repeatedly at high spee… |
CVE-2019-16305 | High | 8.8 | 2019-09-14 | In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the user wants to run Mo… |
CVE-2019-13475 | High | 8.8 | 2019-07-09 | In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user… |
CVE-2019-7690 | Critical | 9.8 | 2019-05-13 | In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the lifetime of the proce… |
CVE-2017-15376 | Critical | 9.8 | 2017-10-16 | The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which allows remote attackers to execute arbitrary commands via TCP port 23. |
CVE-2017-6805 | Medium | 5.3 | 2017-03-20 | Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read arbitrary files via a .. (dot dot) in a… |
CVE-2015-7244 | | | 2015-11-04 | The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require authentication for X11… |