CVE-2025-0714: Insecure storage of sensitive information in MobaXTerm <25.0.
The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) consisting only of zero bytes and a master key to encrypt each password individually. In the default configuration, on opening MobaXTerm, the user is prompted for their password. A derivative of the password is used as the master key. As both the master key and the IV are the same for each stored password, the AES CFB ciphertext depends only on the plaintext (the password). The static IV and master key make it easier to obtain sensitive information and to decrypt data when it is stored at rest.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0714?
CVE-2025-0714 is classified as a high severity vulnerability due to its potential to compromise password security.
How do I fix CVE-2025-0714?
The fix for CVE-2025-0714 is to upgrade MobaXterm to version 25.0 or later.
What is the main issue with CVE-2025-0714?
The main issue with CVE-2025-0714 lies in the static master key used for password encryption, which compromises the uniqueness of the encryption.
Who is affected by CVE-2025-0714?
Users of Mobatek MobaXterm versions below 25.0 are affected by CVE-2025-0714.
What is the impact of CVE-2025-0714 on users?
The impact of CVE-2025-0714 includes the risk of unauthorized access due to predictable password storage.