Executive brief
Mobatek MobaXterm is a popular enhanced terminal for Windows used by IT professionals to manage remote servers and network equipment. A vulnerability in how the application handles session configuration files allows an attacker to take control of a user's computer. By tricking a user into importing and opening a specially crafted session file, an attacker can execute malicious code with the same permissions as the logged-in user, potentially leading to full system compromise or data theft.
Technical details
A classic buffer overflow (CWE-120) exists in Mobatek MobaXterm versions up to and including 12.1. The vulnerability is located in the processing of the 'username' field within .mxtsessions configuration files. By providing an excessively long string in this field, an attacker can trigger a structured exception handling (SEH) overwrite. While the attack vector is categorized as network-based due to the delivery of the malicious file, it requires a user to import and execute the crafted session file. Successful exploitation allows for arbitrary code execution, such as a reverse shell, within the context of the application's process. Public exploit code demonstrates this bypasses standard protections on older Windows environments (e.g., XP) where SafeSEH may not be active.
Affected products
- Mobatek MobaXterm <= 12.1
Timeline
- 2019-08-31: other: Vulnerability discovered by researcher
- 2019-09-27: other: Exploit published on Exploit-DB
- 2026-06-04: advisory: CVE published and added to NVD