CVE-2025-0714
The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) consisting only of zero bytes and a master key to encrypt each password individually. In the default configuration, on opening MobaXTerm, the user is prompted for their password. A derivative of the password is used as the master key. As both the master key and the IV are the same for each stored password, the AES CFB ciphertext depends only on the plaintext (the password). The static IV and master key make it easier to obtain sensitive information and to decrypt data when it is stored at rest.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- EPSS probability
- 0.16%
- CWE
- CWE-1204
- Published
- 2025-02-17
- Last modified
- 2026-03-13
Affected products
- Mobatek MobaXterm
Weakness type
Related vulnerabilities
- CVE-2026-5087 — PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely
- CVE-2026-25998 — strongMan vulnerable to private credential recovery due to key and counter reuse
- CVE-2022-26083 — Generation of weak initialization vector in an Intel(R) IPP Cryptography software library before...
- CVE-2023-2747 — Uninitialized IV in Silicon Labs SE FW v2.0.0 through v 2.2.1 for internally stored data