MobaXterm Password Encryption Vulnerability in Versions Below 25.0
A vulnerability in MobaXterm versions before 25.0 exists in its password storage mechanism. The software uses a master key derived from the user's password and an initialisation vector (IV) consisting only of zero bytes to encrypt passwords. When MobaXterm starts, users are prompted for their password, which is then used to generate the master key. Because both the master key and IV remain constant for each stored password, the AES CFB ciphertext depends solely on the plaintext password. This approach creates a significant security weakness, as the static IV and master key make it considerably easier for attackers to potentially decrypt and obtain sensitive password information when the data is stored at rest.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
mobatek mobaxterm |
Vulmon