CVE-2025-14601

An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.

CVSS

No CVSS.

References

Link	Resource
https://github.com/klsecservices/Advisories/blob/master/KLSA-00343-vsDesk-Task-Scheduler-OS-Command-Injection.md

Configurations

No configuration.

History

29 Sep 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de inyección de comandos del sistema operativo en vsDesk permite a un atacante autenticado con privilegios administrativos ejecutar comandos arbitrarios del sistema operativo debido a un filtrado de entrada insuficiente. Un atacante puede explotar esta falla para interrumpir las operaciones del servidor web, exponer datos sensibles o potencialmente lograr un compromiso total del servidor. Aplique el parche del proveedor https://vsdesk.ru/. Las versiones 14.0101 y posteriores tienen el parche.

Information

Published : 2026-08-20 08:16

Updated : 2026-10-06 22:10

NVD link : CVE-2025-14601

Mitre link : CVE-2025-14601

CVE.ORG link : CVE-2025-14601

JSON object : View

Products Affected

No product.

CWE

CWE-676

Use of Potentially Dangerous Function

{"id": "CVE-2025-14601", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14601", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-20T15:21:11.495704Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "vulnerability@kaspersky.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vulnerability@kaspersky.com", "affectedData": [{"vendor": "vsDesk", "product": "vsDesk", "versions": [{"status": "affected", "version": "11.06.02"}, {"status": "unaffected", "version": "14.0101"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-20T08:16:46.273", "references": [{"url": "https://github.com/klsecservices/Advisories/blob/master/KLSA-00343-vsDesk-Task-Scheduler-OS-Command-Injection.md", "source": "vulnerability@kaspersky.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vulnerability@kaspersky.com", "description": [{"lang": "en", "value": "CWE-676"}]}], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise.\n\n\n\n\nApply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en vsDesk permite a un atacante autenticado con privilegios administrativos ejecutar comandos arbitrarios del sistema operativo debido a un filtrado de entrada insuficiente. Un atacante puede explotar esta falla para interrumpir las operaciones del servidor web, exponer datos sensibles o potencialmente lograr un compromiso total del servidor.\n\nAplique el parche del proveedor https://vsdesk.ru/. Las versiones 14.0101 y posteriores tienen el parche."}], "lastModified": "2026-10-06T22:10:00.247", "sourceIdentifier": "vulnerability@kaspersky.com"}