How severe is CVE-2021-28847?

CVE-2021-28847 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2021-28847 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (70th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-28847?

CVE-2021-28847 affects Mobatek Mobaxterm. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-28847?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2021-28847 published?

CVE-2021-28847 was published on 2021-06-03 and last updated on 2026-06-17.

CVE-2021-28847

CVE-2021-28847 is a high-severity vulnerability in Mobatek Mobaxterm with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 1% (70th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Mobatek Mobaxterm
Published: 2021-06-03
Last modified: 2026-06-17

Description

MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change requests that are sent repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls.

Frequently asked questions

What is CVE-2021-28847?: MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change requests that are sent repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls.
How severe is CVE-2021-28847?: CVE-2021-28847 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2021-28847 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (70th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-28847?: CVE-2021-28847 affects Mobatek Mobaxterm. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-28847?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2021-28847 published?: CVE-2021-28847 was published on 2021-06-03 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:mobatek:mobaxterm:*:*:*:*:home:*:*:*

More vulnerabilities in Mobatek Mobaxterm

CVE-2019-7690 — Critical (CVSS 9.8): In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from…
CVE-2017-15376 — Critical (CVSS 9.8): The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which allows remote attackers to execute…
CVE-2022-38337 — Critical (CVSS 9.1): When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats…
CVE-2019-16305 — High (CVSS 8.8): In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup…
CVE-2019-13475 — High (CVSS 8.8): In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to…
CVE-2022-38336 — High (CVSS 8.1): An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or…

All CVEs affecting Mobatek Mobaxterm →