PT-2024-33022 · Mobaxterm · Mobaxterm

Ahmed Sherif · Published 2024-10-31 · Updated 2024-11-01 · CVE-2024-48200

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MobaXterm version 24.2

Description An issue in MobaXterm allows a local attacker to escalate privileges and execute arbitrary code via the remove function of the MobaXterm MSI, which spawns an Administrative cmd (conhost.exe). This enables the attacker to run any code they want.

Recommendations For MobaXterm version 24.2, as a temporary workaround, consider disabling the remove function of the MobaXterm MSI to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2024-48200

Affected Products

Mobaxterm

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-48200 · Security Note
• https://t.me/cvedetector/9520 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1852098828373028937 · Twitter Post
• https://mobaxterm.mobatek.net/download-home-edition.html · Note
• https://gist.github.com/ahmedsherif/ad56cd3a9ef86cdc05175fb591804c64 · Note
• https://twitter.com/CVEnew/status/1852066494177513770 · Twitter Post