Mobatek Mobaxterm
11 CVEs affecting Mobatek Mobaxterm. Latest disclosed: 2026-03-09. Critical: 3, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-7690 | Critical | 9.8 | 2019-05-13 | In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the lifetime of the proce… |
CVE-2017-15376 | Critical | 9.8 | 2017-10-16 | The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which allows remote attackers to execute arbitrary commands via TCP port 23. |
CVE-2022-38337 | Critical | 9.1 | 2022-12-06 | When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can… |
CVE-2019-16305 | High | 8.8 | 2019-09-14 | In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the user wants to run Mo… |
CVE-2019-13475 | High | 8.8 | 2019-07-09 | In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user… |
CVE-2022-38336 | High | 8.1 | 2022-12-06 | An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication. |
CVE-2026-25866 | High | 7.8 | 2026-03-09 | MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully… |
CVE-2021-28847 | High | 7.5 | 2021-06-03 | MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change requests that are sent repeatedly at high spee… |
CVE-2025-0714 | Medium | 6.5 | 2025-02-17 | The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) consisting only of… |
CVE-2017-6805 | Medium | 5.3 | 2017-03-20 | Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read arbitrary files via a .. (dot dot) in a… |
CVE-2015-7244 | | 2015-11-04 | The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require authentication for X11… |