Mobatime vulnerabilities

Products

• amxgt 100 3
• Mobatime mobile application AMXGT100 3
• Mobatime web application 2
• AMX MTAPI 1
• AMXGT-100 1
• Network Master Clock - DTS 4801 1

Latest Mobatime CVEs

Newest publication first

1. CVE-2025-2407 Missing Authentication & Authorization in Web-API allows adversary unrestricted access

   Published 2025-05-27

   Critical·CVSS 9.3 EPSS 0.51%

   Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network. The vulnerability is fixed in Version 1.5.

2. CVE-2024-12286 MOBATIME Network Master Clock has a use of default credentials vulnerability

   Published 2024-12-10

   Critical·CVSS 9.3 EPSS 0.45%

   MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials.

3. CVE-2023-3066 Mobatime mobile application - Broken authorisation

   Published 2023-06-05

   High·CVSS 8.1 EPSS 0.59%

   Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administratorsThis issue affects Mobatime mobile application AMXGT100: through 1.3.20.

4. CVE-2023-3065 Mobatime mobile application - Authentication bypass

   Published 2023-06-05

   Critical·CVSS 9.1 EPSS 0.78%

   Improper Authentication vulnerability in Mobatime mobile application AMXGT100 allows Authentication Bypass.This issue affects Mobatime mobile application AMXGT100 through 1.3.20.

5. CVE-2023-3064 Mobatime mobile application - Sensitive information disclosure

   Published 2023-06-05

   Medium·CVSS 5.3 EPSS 0.60%

   Anonymous user may get the list of existing users managed by the application, that could ease further attacks (see CVE-2023-3065 and 3066)This issue affects Mobatime mobile application AMXGT100 through 1.3.20.

6. CVE-2023-3033 Mobatime web application - broken authorisation mechanisms

   Published 2023-06-02

   High·CVSS 8.8 EPSS 0.60%

   Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobatime web application: through 06.7.22.

7. CVE-2023-3032 Mobatime web application - Arbitrary file upload (RCE)

   Published 2023-06-02

   High·CVSS 8.8 EPSS 0.82%

   Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application (Documentary proof upload modules) allows a malicious user to Upload a Web Shell to a Web Server.This issue affects Mobatime web application: through 06.7.22.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.