CVE-2025-0714

Katalog CVE

CVSS 6.5 · Medium EPSS 0,16%

Kerentanan Generation of Weak Initialization Vector (IV). Skor CVSS 3.1 6.5 (Medium) menurut CNA.

Deskripsi (NVD)

The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) consisting only of zero bytes and a master key to encrypt each password individually. In the default configuration, on opening MobaXTerm, the user is prompted for their password. A derivative of the password is used as the master key. As both the master key and the IV are the same for each stored password, the AES CFB ciphertext depends only on the plaintext (the password). The static IV and master key make it easier to obtain sensitive information and to decrypt data when it is stored at rest.

Rincian

Terbit di NVD

17 Februari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

6.5 (Medium), sumber CNA
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1204: Generation of Weak Initialization Vector (IV)

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 5,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://www.cirosec.de/sa/sa-2024-012