CVEvulnerability
CVE-2019-7690
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-05-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-255
Description
In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the lifetime of the process, even after the user disconnects from the remote SSH server. This affects Passwordless Authentication that has a Password Protected SSH Private Key.
Affected configurations
• mobatek mobaxterm 11.1
Related
Weakness · not in database (1)
References
- https://github.com/yogeshshe1ke/CVE/blob/master/2019-7690/mobaxterm_exploit.py Exploit, Third Party Advisory
- https://github.com/yogeshshe1ke/CVE/blob/master/2019-7690/mobaxterm_exploit.py Exploit, Third Party Advisory