CVE-2025-0714: Insecure storage of sensitive information in MobaXTerm <25.0.
Sign up for FREE to recieve instant alerts about this vulnerability!
Description
The vulnerability existed in the password storage of Mobateks MobaXterm below 25.0. MobaXTerm uses an initialization vector (IV) that is generated by encrypting null bytes with a derivate of the users master key. As both the master key is static, and AES ECB produces the same output with the same input the IV for AES CFB is always the same.The static IV makes it easier to obtain sensitive information and decrypt data if the data is stored at rest.
Classification
CVE ID: CVE-2025-0714
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.5
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected Products
Vendor: Mobatek
Product: MobaXterm
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 0.11882 (how common is this exploit)
EPSS Date: 2025-03-11 (when was this score calculated)