What’s Vulnerable › Vulnerabilities

CVE-2019-13475

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-07-09 · updated 2026-06-17
• Weakness: CWE-88

Description

In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL. Based on the available command-line arguments of the software, one can simply inject -exec to execute arbitrary commands. The additional arguments -hideterm and -exitwhendone in the payload make the attack less visible.

Affected products

• Mobatek MobaXterm: 11.1

References

• https://www.vulnerability-lab.com/get_content.php?id=2186
• https://www.vulnerability-lab.com/get_content.php?id=2186

Get alerted when CVE-2019-13475 or the next vulnerability affects your stack