CVE-2022-38337

CRITICAL · CVSS 9.1 EPSS 0.73%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2022-12-06 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE

CVE-2022-38337

Severity

CRITICAL

CVSS

9.1

EPSS

0.73%

Original NVD Description

When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can result in a Denial of Service (DoS) for the user if services like fail2ban are used.