CVE-2017-15376

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which allows remote attackers to execute arbitrary commands via TCP port 23.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-153777.5In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signatu CVE-2017-153788.8SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).CVE-2017-153799.8An authentication bypass exists in the E-Sic 1.0 /index (aka login) URI via '=''or' values for the username and password.CVE-2017-15386.5IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive informatio CVE-2017-153806.1XSS exists in the E-Sic 1.0 /cadastro/index.php URI (aka the requester's registration area) via the nome parameter.CVE-2017-153819.8SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php (aka the zip code search script).CVE-2017-153837.8Nero 7.10.1.0 has an unquoted BINARY_PATH_NAME for NBService, exploitable via a Trojan horse Nero.exe file in the %PROGRAMFILES(x86)%\Nero d CVE-2017-153846.1rate-me.php in Rate Me 1.0 has XSS via the id field in a rate action.CVE-2017-153857.8The store_versioninfo_gnu_verdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service CVE-2017-153866.5Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URL CVE-2017-153878.8Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javasc CVE-2017-153888.8Iteration through non-finite points in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds mem