CVE-2024-48200 Overview
CVE-2024-48200 is a local privilege escalation vulnerability in MobaXterm v24.2. The flaw resides in the remove function of the MobaXterm Microsoft Installer (MSI), which spawns an administrative cmd process through conhost.exe. A local attacker can leverage this behavior to execute arbitrary code with elevated privileges. The vulnerability affects confidentiality, integrity, and availability of the host system. Exploitation requires local access but does not require authentication or user interaction, giving a low-privileged user a path to SYSTEM-level command execution during MSI removal operations.
Critical Impact
A local attacker on a workstation running MobaXterm v24.2 can hijack the administrative conhost.exe spawned by the MSI remove routine and execute arbitrary code with elevated privileges.
Affected Products
- MobaXterm v24.2
- MobaXterm Home Edition (v24.2)
- MobaXterm MSI installer package (v24.2)
Discovery Timeline
- 2024-10-31 - CVE-2024-48200 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-48200
Vulnerability Analysis
MobaXterm v24.2 ships with a Windows Installer package that includes a remove (uninstall) action. During execution of this action, the MSI process spawns an elevated console host process (conhost.exe) running an administrative cmd shell. Because the MSI runs in the context of the installer service with elevated rights, any interactive command surface created during removal inherits those privileges.
A local attacker interacts with the elevated cmd window or associated child process to break out of the intended installer workflow. This grants command execution outside the scope of the uninstall operation. The result is arbitrary code execution at a higher privilege level than the invoking user account.
The issue is classified as a local privilege escalation and falls under improper privilege management during installer lifecycle operations. Successful exploitation compromises the confidentiality, integrity, and availability of the endpoint.
Root Cause
The root cause is the MSI removal routine invoking an interactive administrative console (conhost.exe hosting cmd.exe) within the elevated installer context. Spawning an interactive shell from a privileged installer exposes an escalation surface that a standard user can reach during uninstall.
Attack Vector
The attack vector is local. An unprivileged user on the endpoint triggers or observes the MSI remove operation for MobaXterm v24.2 and interacts with the resulting elevated cmd/conhost.exe window to run arbitrary commands as an administrator. No network access and no user credentials are required beyond local logon.
A proof-of-concept describing the interaction with the elevated console is published as a GitHub Gist PoC. Refer to the PoC for the exact interaction steps and process observations.
Detection Methods for CVE-2024-48200
Indicators of Compromise
- Instances of conhost.exe or cmd.exe spawned as a child of msiexec.exe running under NT AUTHORITY\SYSTEM on hosts where MobaXterm is being uninstalled.
- Interactive command execution originating from an MSI uninstall session initiated by a non-administrator user account.
- Creation of files, services, or scheduled tasks by SYSTEM in temporal proximity to a MobaXterm v24.2 removal event.
Detection Strategies
- Alert on msiexec.exe process trees that spawn conhost.exe or cmd.exe with an integrity level of System while the initiating user session is non-admin.
- Correlate Windows Installer event log entries (Event IDs 1033, 1034, 11724) for MobaXterm with process creation events (Event ID 4688 / Sysmon Event ID 1).
- Baseline expected MSI child processes and flag deviations, particularly interactive shells launched during uninstall.
Monitoring Recommendations
- Enable command-line auditing and Sysmon process tree logging on all endpoints where MobaXterm is installed.
- Track uninstall events for MobaXterm v24.2 across the fleet and validate that removals originate from administrator accounts only.
- Monitor for unexpected privilege elevations tied to Windows Installer activity through your endpoint telemetry.
How to Mitigate CVE-2024-48200
Immediate Actions Required
- Inventory endpoints running MobaXterm v24.2 and prioritize upgrade or removal of the vulnerable installer package.
- Restrict uninstall permissions so that only administrators can invoke MSI remove operations for MobaXterm.
- Prevent standard users from interacting with elevated installer UI sessions through Group Policy and User Account Control settings.
Patch Information
No vendor-issued patch identifier is listed in the enriched CVE data. Consult the MobaXterm Home Edition Download page for the latest release and update MobaXterm to a version later than v24.2 when a fixed build is published by Mobatek.
Workarounds
- Remove MobaXterm v24.2 from endpoints where it is not required until a fixed version is available.
- Enforce AlwaysInstallElevated is disabled via Group Policy to reduce the impact of elevated MSI actions.
- Require administrator authentication for all MSI install and uninstall operations through UAC policy hardening.
- Restrict local logon on sensitive hosts to reduce the pool of users who can trigger local privilege escalation.
# Configuration example: verify AlwaysInstallElevated is disabled (should return 0 or not exist)
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated
reg query "HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated
# Inventory MobaXterm installations via PowerShell
Get-WmiObject -Class Win32_Product -Filter "Name LIKE 'MobaXterm%'" | Select-Object Name, Version, Vendor
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
