CVE-2022-38337: Mobatek Mobaxterm

Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days.

When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can result in a Denial of Service (DoS) for the user if services like fail2ban are used.

Affected products

• Mobatek Mobaxterm: up to and including 22.2

Published 2022-12-06. Last modified 2026-06-17.