MobaXterm vulnerabilities
4 known vulnerabilities in MobaXterm from Mobatek. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.5 High severity
MobaXterm: Insufficient Verification of Data Authenticity
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library
- 7.8 High severity
MobaXterm: Unquoted Search Path or Element
MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the search path behavior
- 9.1 Critical severity
Mobaxterm: Use of Hard-coded Credentials
When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can result in a Denial of Service (DoS) for the user if services like fail2ban are used.
- 8.1 High severity
Mobaxterm: Improper Authentication
An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication.