CVE-2025-0714 Insecure storage of sensitive information in MobaXTerm <25.0.
Attackers can decrypt stored passwords due to static IV and master key usage in MobaXterm, exposing sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0714?
CVE-2025-0714 is a medium-severity vulnerability in Mobatek MobaXterm, published on 17 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) consisting only of zero bytes and a master key to encrypt each password individually. In the default configuration, on opening MobaXTerm, the user is prompted for their password. A derivative of the password is used as the master key. As both the master key and the IV are the same for each stored password, the AES CFB ciphertext depends only on the plaintext (the password). The static IV and master key make it easier to obtain sensitive information and to decrypt data when it is stored at rest.
Weakness: CWE-1204
Which versions are affected by CVE-2025-0714?
How do I fix CVE-2025-0714?
No fix has been published for CVE-2025-0714 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-0714 being exploited?
There is no known exploitation of CVE-2025-0714 in the wild and no public exploit code.
Sources
Also known as GHSA-m328-qqmc-777w.