CVE-2019-25741

EUVD-2019-20177
Mobatek MobaXterm 12.1 contains a structured exception handling (SEH) based buffer overflow vulnerability in the username field of session files that allows remote attackers to execute arbitrary code. Attackers can craft a malicious MobaXterm sessions file with overflow data that triggers the vulnerability when imported and executed, enabling reverse shell execution with user privileges.
Classic Buffer Overflow
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
mobatekmobaxterm
12.1
CNA
Common Weakness Enumeration
References
https://download.mobatek.net/1112019010310554/MobaXterm_Portable_v11.1.zip
https://www.exploit-db.com/exploits/47429
https://www.vulncheck.com/advisories/mobatek-mobaxterm-buffer-overflow-via-sessions-file